Self-hosted · OpenAI + Anthropic · Docker ready

Stop runaway AI spend
before it stops you.

A drop-in proxy that enforces per-customer token budgets on every LLM request. Block abuse with 429. Never take down production when Redis hiccups.

architecture.flow
Your App
Token Guard
OpenAI / Anthropic
Redis
$
curl https://tokenguard.ai/v1/chat/completions \
-H "x-bucket: customer-123"
200 OK·tokens deducted from bucket
429 Too Many Requests·budget exhausted

Built for peace of mind

Every feature designed to keep your LLM API costs predictable and your production stable.

Real-time Budget Enforcement

Returns HTTP 429 when budget is exhausted — blocks the request BEFORE it reaches the LLM provider. No surprise bills.

Per-Bucket Token Budgets

Set limits per customer, feature, or environment. Track usage from real provider metadata for both streaming and non-streaming responses.

Fail-Open Architecture

If Redis is down, LLM traffic still flows. Availability over enforcement — never take down production because of rate limiting.

Self-Hosted & Private

Deploy via Docker Compose in your own infra. No vendor lock-in, no data leaving your network. Your API keys pass through unchanged.

Admin API for Balance Management

Get, set, or top up bucket balances via REST API. No need for redis-cli or manual database manipulation.

Zero Latency Overhead

Tiny footprint, minimal latency. Drop-in replacement for OpenAI/Anthropic endpoints — works with existing SDKs.

Single Provider, Single Instance

One upstream per deploy. Point Token Guard at OpenAI or Anthropic — your app calls one consistent endpoint.

Abuse Prevention

Stop bad actors from draining your credits. Per-customer quotas mean one compromised key can't burn your whole budget.

How It Works

Drop-in protection in 4 steps

Point your app at Token Guard. Add bucket headers. That's it.

1

Add Token Guard to your stack

Deploy via Docker Compose. Point your app at Token Guard instead of the LLM provider. Pass your existing provider keys through unchanged.

# docker-compose.yml
services:
  token-guard:
    image: tokenguard/token-guard:latest
    ports:
      - "8000:8000"
    environment:
      - UPSTREAM_URL=https://api.openai.com
      - REDIS_URL=redis://redis:6379
2

Set bucket budgets

Create a budget bucket for each customer, feature, or environment. Use the Admin API to set token limits and top up balances.

# Create a bucket with 100K tokens
curl -X PUT http://localhost:8000/admin/buckets/customer-123 \
  -H "Content-Type: application/json" \
  -d '{"balance": 100000}
3
200 OK
429 Budget

Make requests with bucket headers

Include the bucket ID in your request headers. Token Guard checks the budget before forwarding. If exhausted, returns 429 immediately.

# Your app sends requests with bucket header
curl https://tokenguard.ai/v1/chat/completions \
  -H "Authorization: Bearer YOUR_OPENAI_KEY" \
  -H "x-bucket: customer-123" \
  -d '{"model": "gpt-4", "messages": [...}'
4

Tokens deducted automatically

Token Guard reads the usage metadata from the provider response (streaming or non-streaming) and deducts tokens from the bucket balance.

# Response includes usage info
{
  "id": "chatcmpl-abc123",
  "usage": {
    "prompt_tokens": 25,
    "completion_tokens": 100,
    "total_tokens": 125
  }
}
# → 125 tokens deducted from bucket
Your App
Token Guard
Redis
OpenAI / Anthropic

Simple pricing. Open source first.

Free forever. Self-host everything. Pro features coming soon for teams that want managed infrastructure.

Open Source

Freeforever

Self-host. Production-ready. MIT licensed.

  • Unlimited buckets
  • OpenAI + Anthropic support
  • Streaming & non-streaming
  • Admin API
  • Fail-open mode
  • Docker Compose deployment
  • Community support
Coming Soon

Pro

Coming Soon

Managed cloud. Analytics dashboard.

  • Everything in Open Source
  • Managed cloud hosting
  • Real-time analytics dashboard
  • Dollar-based budgets
  • Email/Slack alerts
  • SAML SSO
  • Priority support

What Token Guard is NOT (yet)

We believe in being upfront about limitations. Here's what's not included in v1:

Not a managed SaaS dashboard (v1 is self-hosted)
Not dollar-based billing (token counts only)
Not an API key manager (keys pass through)
Not multi-provider per instance
Quick Start

Up and running in 5 minutes

Clone. Configure. Deploy. Start protecting your LLM API budget.

1

Clone the repository

git clone https://github.com/sakshamrai101/token_guard_ai.git
cd token_guard_ai

Or use the Docker image directly

2

Configure environment

# .env
UPSTREAM_URL=https://api.openai.com
REDIS_URL=redis://localhost:6379
PORT=8000

Point to OpenAI or Anthropic

3

Deploy with Docker

docker-compose up -d

Token Guard is now running on port 8000

4

Set a bucket budget

curl -X PUT http://localhost:8000/admin/buckets/my-first-bucket \
  -d '{"balance": 100000}'

100K tokens allocated

5

Make your first request

curl http://localhost:8000/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "x-bucket: my-first-bucket" \
  -d '{"model":"gpt-4","messages":[...]}'

Tokens deducted automatically

Ready to protect your API budget?

Deploy Token Guard today and never get surprised by runaway LLM costs again.

FAQ

Frequently asked questions

Everything you need to know about Token Guard.

Still have questions?

Open an issue on GitHub or reach out to the team.