LLM Gateway's Two Founders on Enterprise Routing, AirSide, and Token Fraud

On August 7th, a weekly benchmark published by a third-party company called ComputeSDK ranked LLM Gateway first. Ismail Ghallou, who co-founded the company with Luca Steeb, points out that the other names on that list belong to "multi-million, billion-dollar competitors." LLM Gateway, by contrast, is two people. "We're only two guys behind this LLM Gateway," he said on his return visit to DevNTell, roughly a year after the pair first appeared on the show.

LLM Gateway offers a single OpenAI-compatible API for sending requests to models from many providers while tracking prompts, costs, and usage in one place. The company currently advertises more than 200 models across more than 40 providers. Its core is open source under AGPLv3, and a set of commercial features lives in a separately licensed enterprise edition.

A Telegram Message and No Roadmap

Luca and Ismail have known each other for almost a decade. About a year and a half ago, Luca, who describes himself as more of a DevOps person, was working on AI automations and kept running into the same friction. Every model provider had its own integration, its own sign-up, and its own billing, and some platforms did not report usage insights until a day later. He messaged Ismail on Telegram to ask whether he wanted to build something that fixed it.

Ismail, who started out as a designer before becoming a developer and now calls himself "just a builder," had been thinking about the same idea. He recalled how quickly it came together:

There was no planning, no meetings, no product strategy or market strategy. We just went on and started building.

In the early days they used Cursor and v0, but still read the code and kept pull requests small because the models were not yet reliable. Ismail said trust grew when Opus 4.5 arrived in December, and that after Fable 5 and later Astra, the two stopped reading the code altogether. CodeRabbit, which is free for open source projects, reviews every pull request. Another AI tests each change and records the result, and the founders maintain a collection of agent skills meant to make the codebase easier for models to work in without producing slop.

SOC 2 and the Enterprise Shift

The largest change since the first episode, according to Luca, is who is signing up. LLM Gateway obtained SOC 2 Type II compliance, which larger US companies require, and that opened the door to enterprise sales. Those customers describe a familiar problem at a bigger scale. They hold direct contracts with flagship providers that commit them to annual spending amounts, some developers use Claude Code while others use Codex, and managers have no single place to set limits. Some of these companies spend tens or hundreds of thousands of dollars a month on tokens, Luca said, "maybe even millions," and many want to try open source models that their existing contracts make awkward to adopt. With LLM Gateway in the middle, he said, switching a coding agent over takes "two config lines," and spend limits live in one place.

Ismail listed what enterprise clients asked for and got: automatic retries and fallback, regional model support for Azure, GCP, and Alibaba, team access, SSO, audit logs, guardrails, and provider compliance policies that restrict routing to providers certified for GDPR or ISO 27001, or filter by where the provider is headquartered. One client wanted to define its own fallback chains, which became dynamic routes, configurable through the API or a dashboard GUI. He described the process for requests like that:

Whenever they request a feature, there is no meeting, no planning between me and Luca. We immediately go, one of us takes it, owns it, ships it, and communicates it to the enterprise client.

Luca framed this as the place a two-person company can compete. A year or two ago, he said, a large customer would have wondered, "can these guys actually have the ability to ship this fast?" His view is that the question now has a different answer.

Airlines and Airport Tax

AirSide came out of a manual chore. Smaller inference providers would email Ismail or Luca, get added to a Discord server or Slack workspace, and list the models they supported. One of the founders would then open a pull request, test the models, and merge it. Every new model or change meant another pull request. AirSide turned that into a self-serve portal where providers submit their APIs, models, and pricing for approval. Its published onboarding fee is $2,500 per provider company, with waivers available through invite codes.

The branding follows an airport theme. Providers are the airlines, and the gateway margin is the airport tax. Providers that raise the margin they pay, or lower the price to end users, get more traffic, provided their throughput and availability hold up. Most of that traffic comes from DevPass, a subscription product for coding agents. Ismail drew the distinction plainly: on LLM Gateway, credits do not expire and the buyer can pin a specific provider for a model, while DevPass subscribers get extra usage but can only choose a routing strategy, such as cheapest or most available. After subscribers asked for zero data retention, DevPass added a "no AI training" toggle that excludes providers who train on prompts.

LLM Gateway publishes its usage on a public page. Ismail said the gateway has processed roughly two to three trillion tokens, and that open source models are the most used.

That preference runs back to the project's origin. Luca recalled looking at OpenRouter when they started: "It's called OpenRouter, but there's nothing open about it, because it's just a closed-source platform." Open source was a requirement for the long-term goal of letting enterprises self-host the gateway. In practice, Luca said, many enterprises still pick the cloud version to avoid maintenance, but the public code lets them verify how it works, and community contributors help fix issues and pricing changes.

Stolen Cards and the October 15 Change

DevPass currently gives three dollars of usage for every dollar of subscription, across plans priced at $29, $79, and $179 a month. Ismail said the minimum gateway margin collected through AirSide is what makes that possible. On October 15, the multiplier drops to 2x for new subscriptions and qualifying renewals. The reason, he said, was mostly abuse. DevPass now limits use to an approved set of coding agents and bans resellers and relayers.

Luca said everyone in the business underestimates the fraud problem, because tokens are not like ordinary SaaS seats. Every dollar a customer spends is a dollar LLM Gateway pays the provider directly.

If people abuse our service, we have incurred the cost already, and if it's stolen credit cards, we get a chargeback from Stripe. So then we have a loss.

Every AI gateway deals with this, he said, but LLM Gateway carries more risk because it is not VC funded and cannot hire people to do fraud detection all day. He called it a cat-and-mouse game that checks and rate limits can contain but not prevent.

Ismail offered AirSide as an example of how the founders split the work. It was built in one day and launched with a single provider testing it. Fixes followed from that provider's feedback, more providers came on, and then Luca added end-to-end tests that each provider now has to pass before being listed. Luca is the infrastructure half of the company, Ismail said, responsible for making sure the system can absorb the load (82 million requests so far), and Ismail is the distribution half. "Whoever gets to distribution faster is the winner," he said.