πŸ”Ž Live demo of the real Allotment AI console β€” read-only, a sample company. Hover any β“˜ to learn a concept. Install your own free instance β†’
Lab console
AllOpenAIAnthropic (Claude)● real data
Org AdminAcme Corp (lab) Β· all users
β–¦Overviewβ—‰My WalletοΌ„Savings & ROIβ–€Seats & Licenses–Auto-sweep⇄Providers⚿Gateway Keys◍Credit Poolsβœ‰Requests‡Allocation Tree​Auto-allocation✦Insightsβš–Reconcile≣Audit logπŸ”‘Licenseβš™Settings
Read-only demo β€” the admin view of Acme Corp, a synthetic company. Nothing here is real and nothing you do is saved. Hover any β“˜ to learn a concept. In a real install everyone signs in with company SSO and sees only their own view. Install your free instance β†’
Settings
Org configuration β€” grouped in tabs; every change is saved to the database.
🌐 Gatewayadd-ons, machine setup and app pools
πŸ”Œ Gateway add-ons
mock gateway
These four govern the lab AI command line, which this install does not serve. What decides each one on live traffic is stated per row β€” none of them is a switch here.
Exact cache (Redis) premiumβ“˜
Live traffic: the gateway caches. litellm_settings.cache: true in install/litellm-config.yaml β€” this console cannot turn it off.
Not a switch
⚑ Cache marker premiumβ“˜
Display flag for the lab AI command line only. The gateway returns its own cache headers to the caller.
Not a switch
!fresh bypass premiumβ“˜
The !fresh prefix exists only in the lab AI command line. For live traffic, cache behaviour is the gateway's β€” install/litellm-config.yaml.
Not a switch
Smart model routing premiumβ“˜
Not shipped for live traffic: install/litellm-config.yaml configures no router. Each call is served by the model the caller asked for.
Not a switch
Per-user limits & budgetsβ“˜
Not in effect β€” the gateway is in MOCK mode, so no real employee traffic passes through it.
Mock gateway
Real-time attributionβ“˜
Not in effect β€” the gateway is in MOCK mode, so no real employee traffic passes through it.
Mock gateway
Configured in the gateway, not here
These are settings of your LiteLLM gateway (install/litellm-config.yaml), not of this console β€” so there is no switch for them here.
Provider fallbacks litellm_settings.fallbacks β€” deliberately unset
Not shipped, on purpose: an OpenAI request must never be silently served and billed by Anthropic (or the reverse). That spends one provider's credits on another β€” breaking "credits are NOT fungible between providers" β€” and bills a person who holds no seat there. Per-key model scoping, set at mint, enforces the same rule.
Semantic cache litellm_settings.cache_params.type: redis-semantic
Needs an embedding model. Set the cache type, similarity threshold and embedding model in the gateway config; this console neither enables nor measures it.
PII guardrails guardrails: presidio-pii (mode: pre_call)
Runs in a Presidio sidecar beside the gateway and is configured there. Nothing in this console scans, redacts or blocks prompt content β€” the console never sees prompt content.
Export to New Relic litellm_settings.success_callback: ["newrelic"]
Set the callback plus NEW_RELIC_LICENSE_KEY on the gateway container. The console exports metrics nowhere.
🧩 Model aliases β“˜
not checked yet
The gateway is in MOCK mode, so there is nothing behind the aliases to probe β€” the weekly check skips itself.
The reviewed set of model ids ships as install/model-allowlist.txt. Nothing in this product asks a provider for its model list β€” no call leaves your perimeter.
πŸ–₯ Employee machine setup β“˜
Self-serve download in My Wallet
each employee can download a file with their own key
Employees can mint their own key
from My Wallet β€” budget auto-set to their wallet balance; spend debits their own wallet

Which tools this actually covers β“˜
Claude Code, Codex CLI and apps on the OpenAI / Anthropic SDKs take a custom base URL + the key you issue β€” those route through the gateway and get hard caps and per-person attribution. Seat-subscription products (GitHub Copilot, Cursor’s bundled models, ChatGPT Enterprise) cannot be intercepted by any gateway β€” they stay aggregate-only: you can reconcile the invoice, you cannot cap the person. Full per-tool matrix, incl. the date each row was last proven end-to-end: docs/tool-compatibility.md in your install directory.
Machine-wide: the setup file writes user-level variables (Windows setx; Mac/Linux a managed block in ~/.zshrc + ~/.bashrc), so OPENAI_BASE_URL redirects every OpenAI-SDK app on that laptop, not just Codex. To scope it, leave the self-serve download OFF and push the variables to just the intended users via GPO / Intune / Jamf.
Internal hostname Β· private CA β“˜
Off β€” public hostname / Let's Encrypt. Setup files stay exactly as they are today.
🎚 Per-key limits β“˜
A cap is not a ceiling: the gateway approves a call against the spend recorded BEFORE it, so up to 4 requests can already be in flight when the last one under the cap is approved. Worst case = the cap + 4 x the cost of one call.
Type 0 to send no limit at all (unbounded) — an empty box leaves that limit exactly as it is, so clearing a field can never quietly drop the only bound on cap overshoot. A soft-budget warning is set at 85% of every key's budget β€” the console raises it; the gateway never refuses on it. The gateway is in MOCK mode, so nothing carries these values.
πŸ€– App pools (service accounts) β“˜
Enable app pools premium
managers can create Application pools + mint their app API keys