Why it is compliant

Compliance for a gateway like this comes down to one question: whose accounts, whose money, and who is responsible. OpenLLM is built so the answer is always "yours." This page explains the design choices that keep it that way, in plain terms.

It is your account, not a resold one

OpenLLM never resells tokens and never adds a markup. When a request runs, it runs on a credential you connected, billed by your provider to you, at the price your provider charges. OpenLLM is not a reseller sitting on a pool of tokens it marks up. It is a router in front of accounts you already own.

This is the core difference from a metered aggregator. An aggregator buys capacity and resells it, which pulls it into the provider's reseller and pricing terms. OpenLLM does neither, so there is nothing to resell and no margin to take.

You bring your own credentials

Nothing works until you connect an account. You paste your own API key or connect your own subscription over OAuth. OpenLLM does not ship with hidden shared keys that everyone rides. Each user's requests run on that user's own credentials, and the relationship with the provider stays between you and the provider.

You are responsible for your own usage

Because it is your account, the provider's terms apply to you directly, the same as if you called the provider without OpenLLM in the path. You agree to use the service lawfully, you are responsible for all activity under your account and keys, and you keep those keys secure. OpenLLM does not change what your provider permits. It only changes how many places you have to configure to reach it.

Concretely, you are expected to:

• Follow the terms of every provider whose account you connect.
• Use the models within those providers' acceptable-use policies.
• Keep your OpenLLM key and provider credentials secure, and revoke them if they leak.

Credentials are handled to reduce risk, not expand it

A common worry with any proxy is that it becomes a soft place to steal keys from. OpenLLM is designed against that:

• Provider API keys are stored only as ciphertext and decrypted in memory per request, so a database dump reveals nothing usable.
• Subscription credentials never route through the cloud at all. They run on the local daemon on your own machine, against the official vendor CLI.

The full mechanics are on Security. The compliance point is that your credentials are held with less exposure than a plaintext config file on your laptop, not more.

Subscription accounts: an honest note

Driving coding agents from a consumer subscription rather than a metered API key is the feature developers want most, and it is also the area where provider terms vary and can change. OpenLLM's design keeps this as clean as possible: the subscription runs locally, through the vendor's own official CLI, using your own login, exactly as if you ran that CLI by hand. It does not scrape, spoof, or share subscription sessions across users.

Even so, each provider decides what its subscription may be used for, and those policies are theirs to set. Read the terms for any subscription you connect and use it within them. If a provider's terms restrict a use, that restriction applies to you regardless of the tool in front of it.