What Are Gateways?

A gateway is a ready-made record on your domain that points at a third-party service. You pick it from a catalog and nsin creates the record for you — with the right destination, the right Host header and the right TLS settings already filled in.

The result is a hostname of your own, like ai-40218.example.ir, that answers exactly like the service behind it.

What they’re for

Gateways are for API calls and package clients — the things your code and your terminal talk to:

• AI & LLM — OpenAI, Anthropic, Google Gemini, OpenRouter, DeepSeek, Groq, Mistral, xAI, Cohere, Hugging Face.
• Packages & build — npm, PyPI, uv, Docker Hub, Microsoft Container Registry, crates.io, Go modules, Maven, Gradle, NuGet, the GitHub API.
• Messaging — Telegram, Discord, Slack, WhatsApp Business.
• Cloud & platform — Google APIs and OAuth, Firebase Cloud Messaging, Firestore, Supabase, Apple APNs, Twilio, SendGrid, the Cloudflare API.

The catalog is maintained by nsin, so new services appear on your Gateways page without you configuring anything.

Caution

Gateways are not a way to open a third-party website in a browser. They serve API endpoints and package clients, and browsing a service’s web UI through one will not work.

Turning one on

1. Open your domain in the dashboard and go to Gateways.
2. Find the service you need — use the search box or the category filter.
3. Press Enable.

nsin creates a proxied record named <service>-<5 digits>.<your-domain> and issues a certificate for it. You can rename it afterwards to something you’ll recognise, and remove it whenever you like.

The first time you enable a gateway on a domain, you’ll be asked to accept a short terms notice — see Shared egress addresses below.

Requirements

• Your domain must use nsin’s DNS. A gateway is a record on your zone, so a domain running on external nameservers cannot have one. See Nameservers.
• Your plan must include gateways. If the page shows a lock, the feature isn’t on this domain’s plan — see Plans & Limits.
• A gateway uses a record slot, like any other record on the zone.

Usage limits

Gateway traffic is metered separately from your site’s own traffic, on a rolling 30-day window, along two axes:

Meter	Why it exists
Requests	The number of calls your gateways served.
Gigabytes	What those calls actually moved.

Both exist because one does not predict the other. A single docker pull is mostly tiny redirect and authentication requests, with almost all of the bytes in one response — so a request count says very little about the size of a pull.

Your plan sets the ceiling on each. The Gateways page shows where you stand, and you’ll be notified as you approach the limit.

If you do pass it, only the gateway hostnames stop serving — the rest of your domain is unaffected. And because the window rolls rather than resetting on a date, older usage ages out continuously and your gateways come back on their own.

Shared egress addresses

Gateway traffic leaves nsin from addresses shared with other customers, and those addresses can change.

This matters in practice: a provider that sees your calls arriving from an IP it doesn’t associate with your account — or one that another customer has already had flagged — may restrict or ban that account. That is why nsin asks you to accept a short terms notice, per domain, before your first gateway goes live.

If you need a stable identity at the provider, contact us about a dedicated address.

Privacy

Your credentials travel inside your own request to the provider, exactly as they would without a gateway. nsin does not store them and never adds keys of its own — you always authenticate as yourself.

Gateway requests appear in your own logs and analytics like any other request on your domain.

What’s next

• Using a Gateway — the base URL, and the setup for each kind of client.