A gateway in between,
with controls you can inspect.
EveryAPI authenticates, routes, and relays requests to selected upstream model providers. This page documents the credential controls, usage metadata, network entry points, and compliance work that are currently available without making promises beyond the shipped system.
Requests and responses
as they pass through EveryAPI.
Usage and billing metadata is retained according to the service's operational policy. Retention and deletion are administered by the service; contact support for an export or deletion request when the dashboard does not provide that action.
Keys —
how they're stored and revoked.
API keys are bearer credentials stored by the service so requests can be authenticated. Treat every key as a secret, keep it out of client-side code, and rotate or revoke it if it may have been exposed.
Create separate keys for separate workloads. Each key can have its own model allowlist, IP restrictions, scopes, and available quota, so access can be limited without sharing one credential everywhere.
Revoke an exposed key in the dashboard to reject subsequent requests made with it. The dashboard also shows usage and recent access time to help you investigate and replace the credential.
The path
from client to upstream.
Use the documented HTTPS API endpoints and keep bearer keys out of URLs, logs, browser bundles, and public repositories. Client TLS behavior and certificate validation should remain enabled.
EveryAPI offers a global API entry point and a China-priority entry point. Both relay requests to the selected provider; choose based on measured connectivity rather than assuming a fixed latency or region.
The gateway maps authentication and, when required, translates between supported OpenAI, Claude, and Gemini protocol shapes. Fields and streaming events are relayed according to the selected endpoint and model capability, so test protocol-specific behavior.
Compliance documents
and current status.
Published materials link to their current pages below; items still being prepared remain marked in progress. To discuss an enterprise DPA, email legal@everyapi.ai.
- PublishedScope of collected metadata, retention periods, user rights
- PublishedAccounts, billing, refunds, allocation of liability
- In progressICP FilingDomestic filing information is not yet published on this page
- In progressEnterprise DPAEnterprise data-processing terms are still being prepared; contact legal for current options
- PublishedLive gateway and upstream availability signals
Found an issue?
Get in touch.
Security researchers can report a suspected vulnerability to security@everyapi.ai. Include reproducible details without sending production secrets or personal data, and avoid public disclosure while the report is being assessed and remediated.
Most other details can be found in the FAQ — for example, whether providers collect prompts, sign-in methods, and access latency within China.