Provider access stays separate from application control.
01
Match the route to the exact API
Groq documents both Chat Completions and a Responses API, but capability support can differ by model and parameter. The gateway admits only a target that matches the workload's request boundary instead of assuming every catalog entry is interchangeable.
02
Absorb bursts within a declared ceiling
Per-workload request, token, and concurrency controls prevent one fast client from consuming the shared provider allowance unchecked. Retries and fallback remain bounded so a rate limit cannot turn into an uncontrolled request multiplier.
03
Keep provider access write-only
The Groq API key stays in the encrypted provider credential boundary. Applications receive scoped AI Gateway HQ keys, while administrators can rotate the upstream key and review route decisions without placing it in source control or shell history.
Current shared controls
Status determines what can be configured.
Write-only, encrypted BYOK for implemented provider connections Stable model aliases and protocol-eligible route targets Organization and key budgets, RPM, TPM, and concurrency hard limits Observe, Shadow, Enforce, reason codes, and metadata-only evidence
Beta connections require customer validation against the exact model, payload, streaming mode, region, and provider account before production use.