Self-hosted or managed gateway

"Self-hosting" here means running the official Anthropic SDK behind your own authentication and rate-limit layer (usually Kong, Cloudflare Workers or an in-house Express/Fastify proxy). At large volumes this makes sense, but an honest count of its cost is rare.

What you have to build yourself

• API key issuance, rotation, revocation
• Per-key request limit (token bucket + Redis)
• Per-key list of allowed models
• Per-key list of allowed IPs
• Usage metering (input, output and cache tokens) by key, model and day
• Cost calculation in cents per 1M tokens, margin included
• Balance top-ups and payment provider integration (SBP, cards, crypto for RU/CIS)
• An SSE streaming proxy with backpressure
• A converter to the OpenAI-compatible format (chat.completions ↔ messages)
• Handling of payment webhooks and chargebacks
• An admin interface for managing sub-orgs
• An audit log and GDPR export
• A dashboard for keys, usage and balance
• On-call duty and an uptime SLA

Total cost of ownership

A rough first-year TCO estimate at low to medium load (≈100M tokens per month):

Architecture you have to assemble

A production gateway cannot be reduced to "calling the SDK". The minimum set of components:

• An edge proxy (Cloudflare Workers or NGINX): terminates TLS and applies a per-key limit before the LLM is called
• An authentication service: maps a bearer token to an internal account_id in under 5 ms and checks for revocation
• A streaming transformer: buffers SSE from Anthropic, counts tokens on the fly and hands them to the client without head-of-line blocking
• Postgres for the billing ledger and for enforcing the balance (a single request that slips through after the balance hits zero is real money lost)
• Redis for rate-limit counters and short-lived session state
• Background workers for payment webhooks, balance reconciliation and cleaning up stuck streams
• Observability: per-key latency histograms, error budgets, alerts on Anthropic 5xx

Each item takes 1-3 days. That is why a serious self-hosted gateway costs an engineer a quarter, not a weekend.

Compliance and security

Key protection, data subject requests, logs and incidents need to be checked under any setup. codexkey's legal section confirms neither a certification nor compliance with every requirement of a particular customer. A DPA is drawn up separately, after the route and recipients are verified. If your contract forbids sending data outside your VPC, an external gateway is not suitable without an agreed exception.

Scaling pain points self-host hits first

• 429 from Anthropic during bursts: without a correct retry-after you end up DDoSing yourself
• Parallel streams: every SSE holds a goroutine or thread, and Node falls over at around 1k concurrent streams by default
• A balance race: two parallel requests both pass the check and push the balance below zero, so you need SELECT FOR UPDATE
• Cache invalidation when Anthropic changes model snapshot ids
• Cost reconciliation: input and output tokens arrive in the response headers, not the request's, so billing happens after the fact

When self-hosting still makes sense

• Your contract forbids sending traffic outside your VPC or cloud account
• You handle PHI/PCI data and need a BAA and an audit trail that you control
• Your volume is above 10B tokens a month and you have signed a direct enterprise contract with Anthropic

A hybrid setup

Many teams start with a prototype on codexkey and move the load to their own gateway only when one of the conditions above holds. Because codexkey has an OpenAI-compatible interface, the move is mostly a configuration change.

How to move to self-hosting later

codexkey serves both the native Anthropic interface and an OpenAI-compatible one, so client code moves over without a rewrite. When you decide to self-host, only the base URL and the key-issuing logic change, and the request and response shapes stay the same. Most teams that self-hosted too early admit that on a managed gateway they would have shipped 4-8 weeks sooner.

Real numbers from teams who tried both

According to surveys of teams that first self-hosted and then gave up, the median time to the first paying customer was 9 weeks. The same teams shipped in 2-5 days on codexkey. The unit economics swing in favor of self-hosting only above ~5B tokens a month and with a platform team already in place. Below that, engineer hours cost more than the markup.

FAQ

Can I use my own Anthropic key with codexkey?

No. codexkey works as a reseller: you pay codexkey, not Anthropic, and we hold the upstream contract.

Are there request limits per key?

A key can have a name, a Premium or Cheap channel, a Premium fallback for Cheap and an expiry date, and the statistics show its usage. RPM/TPM, concurrency, budgets, model lists, IP filters and IDE restrictions cannot be set through the dashboard key API.

Can I export usage data?

Yes. A CSV export is available by key, sub-org and date range, from the dashboard and through the admin API.

What is the cold-start delay of a serverless self-host?

A Lambda or Workers cold start adds 200-800 ms to the first request after idle time. codexkey keeps a warm pool, so that cost is spread across all clients.

How do I keep up with Anthropic SDK upgrades in my own gateway?

You follow @anthropic-ai/sdk releases yourself, run integration tests on new snapshot ids and roll out updates without cutting off client streams. In codexkey SDK updates happen unnoticed: client code does not change.

Can I split traffic 50/50 between a self-host and codexkey?

Yes. Many teams use codexkey as a multi-region failover for when their main self-hosted gateway has an incident. The API interface is the same, so round-robin or weighted routing on a load balancer is trivial to set up.

Does self-hosting pay off at 1B tokens a month?

Almost never. codexkey's markup on 1B tokens is less than the salary of one platform engineer who would maintain such a stack. The break-even point is around 5-10B tokens a month, and only with an on-call rotation already in place.

What about audit logs and SOC 2 reports?

Logs on their own do not prove SOC 2 certification. A DPA for codexkey has to be agreed separately, covering actual processing, recipients and safeguards. For regulated data, first check the customer's requirements and the legal documents, and do not rely on the promises of a comparison page.