He-API
A self-hosted OpenAI-compatible API gateway that consolidates the interfaces of multiple Chinese large model providers into a single OpenAI-compatible endpoint, addressing issues of authentication, payment, and format inconsistency in cross-region access.
Timeline (last 90 days)
He-API is a self-hosted API gateway that consolidates six Chinese large-model providers — DeepSeek, Kimi, Qwen, Doubao, ERNIE and GLM — behind a single OpenAI-compatible endpoint.
He-API's architecture chain is: client (any OpenAI SDK) → Nginx + Let's Encrypt → the api-gateway written in Go, inside which the request passes in order through a Redis-backed permission resolver, a rate limiter implemented with Redis + Lua, a model router, and each provider's adapter layer (kimi / deepseek / qwen / doubao / ernie / glm), finally hitting the upstream provider.
He-API's usage events are written to ClickHouse via Kafka, while billing, model and provider metadata land in PostgreSQL; the system comprises 15 services running on systemd, all in Go except one Next.js admin console; the middleware includes Postgres, Kafka, Redis and ClickHouse, and all 22 migration scripts are idempotent.
Because providers report usage in inconsistent ways, upstream numbers cannot be blindly trusted; the author ultimately parses usage on the gateway side and keeps a local estimation fallback for streaming requests that never report usage, while retaining per-request audit detail.
He-API's provider keys are encrypted at rest with AES-256-GCM and decrypted only in memory; the gateway polls an internal active providers endpoint every 30 seconds and atomically replaces the provider set in memory, thereby achieving hot reload.
All Facts (5)
He-API is a self-hosted API gateway that consolidates six Chinese large-model providers — DeepSeek, Kimi, Qwen, Doubao, ERNIE and GLM — behind a single OpenAI-compatible endpoint.
50%UnverifiedHe-API's architecture chain is: client (any OpenAI SDK) → Nginx + Let's Encrypt → the api-gateway written in Go, inside which the request passes in order through a Redis-backed permission resolver, a rate limiter implemented with Redis + Lua, a model router, and each provider's adapter layer (kimi / deepseek / qwen / doubao / ernie / glm), finally hitting the upstream provider.
50%UnverifiedHe-API's usage events are written to ClickHouse via Kafka, while billing, model and provider metadata land in PostgreSQL; the system comprises 15 services running on systemd, all in Go except one Next.js admin console; the middleware includes Postgres, Kafka, Redis and ClickHouse, and all 22 migration scripts are idempotent.
50%UnverifiedBecause providers report usage in inconsistent ways, upstream numbers cannot be blindly trusted; the author ultimately parses usage on the gateway side and keeps a local estimation fallback for streaming requests that never report usage, while retaining per-request audit detail.
50%UnverifiedHe-API's provider keys are encrypted at rest with AES-256-GCM and decrypted only in memory; the gateway polls an internal active providers endpoint every 30 seconds and atomically replaces the provider set in memory, thereby achieving hot reload.
50%