European AI gateway · SaaS · Hybrid · Self-host
One proxy between every AI client and every LLM. Govern your agents in a few clicks, charge every euro back to the team that spent it, and keep your prompts where they must stay.
How it works
Connect your apps and agents to the TokenSaver gateway by changing one URL. Every call goes through your rules: budget, approved models, sensitive data. And every euro is tied to a team.
In SaaS or on your own open-source gateway. Try it below ↓
export ANTHROPIC_BASE_URL=https://api.tokensaver.cloud/anthropic
export ANTHROPIC_AUTH_TOKEN=tsv_...
claudefrom langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-oss-120b", base_url="https://api.tokensaver.cloud/openai/v1", api_key="tsv_...")client = OpenAI(base_url="https://api.tokensaver.cloud/openai/v1", api_key="tsv_...")const client = new OpenAI({ baseURL: "https://api.tokensaver.cloud/openai/v1", apiKey: "tsv_..." });curl https://api.tokensaver.cloud/openai/v1/chat/completions -H "Authorization: Bearer tsv_..." \
-d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"Hello"}]}'Only the URL and the key change: the rest of your code stays as is. Moving from the SaaS gateway to your own means changing the URL once more.
At scale · Architecture
Example: Sales goes through the SaaS gateway, Engineering and Finance through their on-prem gateways. The console sets keys, budgets and approved models for each one. Prompts and documents stay in each gateway; only metadata goes up. If the console is down, the gateways keep serving.
← Swipe the diagram →
One AI gateway per team.
Works with the stack your teams already run
Get started
Same console, same virtual keys, same rules. Only the place your prompts go through changes.
Free plan Try SaaS and hybrid for 30 days, no credit card.
1 · SaaS
The code to paste is in “Connect an app”, at the top of the page.
2 · Hybrid
127.0.0.1:8001.Up to 3 gateways on the same control plane: one per team, site or environment. Repeat steps 1 to 3 on each machine.
Available from the Free plan. After the 30-day trial, your gateway keeps serving on its own; the console comes back with a paid plan.
The connection always goes from your gateway to the Cloud: no inbound port to open. Prompts stay on your side; only metadata goes up.
Add a machine
macOS or Linux · Docker recommended, otherwise Python 3.11+
① Install the gateway
gh api -H "Accept: application/vnd.github.raw" \
repos/tokensaver-ai/tokensaver-gateway/contents/scripts/curl-install.sh \
| bashInstalls into ./tokensaver-gateway and opens a wizard to link your Cloud account.
During the beta, the gateway repository is private. This command uses your GitHub session (gh) and only works once your access has been granted.
tokensaver-ai/tokensaver-gateway repository sent by email.gh auth login, then run command ①.② Enroll it on the control plane
cd tokensaver-gateway
./scripts/enroll-data-plane.sh \
--enroll-token '<token copied from the console>' \
--control-plane https://control.tokensaver.cloud \
--merge-env .env.gatewayBetter: copy the command from the console, where the token is already filled in. Gateway already installed? Start here.
3 · Self-host · Enterprise
For regulated environments: the whole platform runs in your infrastructure, disconnected from the internet if needed. Nothing leaves, not even metadata.
Available under the Enterprise license only. We review your architecture with you.
Product tour
50 seconds in the real console, no mock-ups: the proxy in front of every LLM, the graph of an agent run, Claude Code tracking, compression and cost per team.
Use case · Developers
The free, open-source TokenSaver extension sits in the Claude Code flow. You see what the agent really does, what it costs and which files it wrote. No terminal, no pip install.
Mode 1 · Keep my Claude
Keep your Claude plan. No API key, no extra LLM bill. Every session is captured: calls, tools, files, tokens and cost.
Mode 2 · Route with TokenSaver
Go through your gateway. Claude Code uses a TokenSaver key: approved models (Claude, Mistral, local models…) and team quotas apply.
code --install-extension tokensaver.tokensaver-claudeTokenSaver: Connect, then Start — Keep my Claude or Start — Route with TokenSaver.
AI governance · chargeback
Rules are set in the console and applied on every call, whether it comes from Claude Code, Cursor, n8n or your own apps. Nothing to code.
Approve models and MCP tools in the Agent Registry. Anything not approved is refused by default.
Switch on policies in one click: PII masking, cache, compression, RAG. No code to change.
Cap quotas and budgets per key, team and project, with overrun alerts before the bill arrives.
Each team gets its own virtual key: tokens, cost and savings land on the right cost center, without spreadsheets.
Illustrative example · month to date
| Team | Cost center | Spend | Budget |
|---|---|---|---|
| R&D · Claude Code | CC-410 | €3,412 | |
| Data & analytics | CC-520 | €1,870 | |
| Customer support | CC-220 | €940 | |
| Marketing | CC-130 | €415 |
Marketing at 97% of budget · alert sent
For CIOs and CISOs · Sovereignty
The gateway (data plane) runs inside your perimeter and enforces the rules. The console (control plane) defines them, in our European cloud or on your side. In SaaS, the gateway also runs in our European cloud.
In hybrid and self-host, prompts, responses, LLM keys, cache and RAG stay on your gateway. The control plane only receives metadata, unless you choose to send more.
Agentic RAG indexes your documents in the gateway, and a corpus can be shared across teams and gateways, whatever the LLM. For each question, only the relevant passages are sent to the model, after compression and personal-data masking. Full documents never leave the gateway.
Your LLM provider keys stay in the gateway. Each use case gets its own virtual key, with its budget, revocable at any time.
Open-source gateway, OpenAI- and Anthropic-compatible APIs, your own keys (BYOK). If the console is down, the gateway keeps serving on its last configuration.
TokenSaver SAS, Aix-en-Provence. French law, GDPR data processing agreement (art. 28), the CNIL as supervisory authority.
Signed traces for every call: agent, model, policy applied, outcome. OpenTelemetry and SIEM export for your AI Act and GDPR audits.
CLOUD Act: in SaaS, the platform is hosted in European datacenters. If this matters to you, choose self-host, up to air-gapped: nothing leaves your infrastructure. See our subprocessors
In SaaS, yes: they go through our gateway, hosted in European datacenters, then to the LLM provider you choose, with your keys. In hybrid or self-host, no: they stay on your gateway, and the control plane only receives metadata (model, tokens, cost, status).
Not in full. Agentic RAG keeps your documents in the gateway and only sends the model the passages relevant to the question, after compression and personal-data masking. In hybrid or self-host, documents stay in your infrastructure.
Yes, from the Free plan. You keep the same organization, the same virtual keys and the same policies: you enroll a gateway, then replace your apps’ base URL with your gateway’s.
No. The connection always goes from the gateway to the control plane: enrollment, signed configuration, metadata. The control plane never opens a connection to your gateway.
In SaaS: a browser and a key from at least one LLM provider. For a private gateway: macOS or Linux, ideally with Docker (otherwise the install runs on native Python).
The control plane and the cloud console stop, and access to the SaaS gateway is revoked: to keep using SaaS, move to a paid plan. A private gateway, enrolled or not, keeps running on your side, on its own, with no quota limit, configured by hand. The VS Code extension keeps connecting to it.
Yes. The gateway is a set of containers or local processes: stop them and delete the folder. In VS Code, “TokenSaver: Disconnect” removes the variables and secrets set by the extension.
Personalised demo, governed 30-day POC, Early Adopter pricing.
Member of La French Tech Aix-Marseille