Using a Gateway

Every gateway gives you one thing: a hostname on your own domain. Whatever you were pointing at the service, point at that instead.

The dashboard shows a How to use dialog for each gateway you enable, with the exact lines for that service. This page covers the shapes those lines take.

Throughout, replace the example hostnames with your own.

REST and SDK clients

Most SDKs accept a base URL. That is the only thing that changes.

import OpenAI from 'openai';

const openai = new OpenAI({
  baseURL: 'https://ai-40218.example.ir/v1',
  apiKey: process.env.OPENAI_API_KEY,
});

from anthropic import Anthropic

client = Anthropic(
    base_url="https://claude-18830.example.ir",
    api_key=os.environ["ANTHROPIC_API_KEY"],
)

Streaming works normally — responses are passed through as they arrive, not buffered.

For a plain HTTP call, swap the host and keep everything else:

GW=https://tg-60412.example.ir

curl -s "$GW/bot$TOKEN/sendMessage" \
  -d chat_id=$CHAT_ID \
  -d text='deploy finished'

Package managers

These take a registry or index URL rather than a base URL.

npm, pnpm & Yarn

npm config set registry https://npm-51074.example.ir/

Per project, in an .npmrc beside package.json:

registry=https://npm-51074.example.ir/

pnpm uses the same command; Yarn 2+ uses npmRegistryServer in .yarnrc.yml.

pip, uv & Poetry

Keep the /simple/ path — that is the index API, not a website path.

pip config set global.index-url https://pypi-33915.example.ir/simple/

# pyproject.toml, for uv
[[tool.uv.index]]
name = "nsin"
url = "https://pypi-33915.example.ir/simple/"
default = true

Docker & other registries

The hostname becomes the registry prefix of the image name:

docker pull docker-77228.example.ir/library/nginx:latest
docker pull docker-77228.example.ir/grafana/grafana:latest

Why registries need no extra work

A registry rarely answers with the thing you asked for. It answers with a redirect or a link to another host: Docker Hub sends you to its blob CDN and its auth service, PyPI’s index links straight at files.pythonhosted.org, crates.io points downloads at static.crates.io, NuGet’s index is full of api.nuget.org URLs.

A plain proxy breaks on the second request, because the client is now being told to fetch a host it can’t reach.

nsin handles this for you. The companion hosts a service redirects to are served under a prefix on your own gateway hostname:

https://docker-77228.example.ir/_nsin/auth.docker.io/token?service=…

and any URL in a response that points at one of them is rewritten into that form on the way out. The real host is dialled with the real path, so signed URLs still validate — only what the client is told to fetch changes. Range requests and resumes on large layer downloads keep working.

You don’t configure any of this; the allowlist ships with the preset.

Renaming a gateway

The generated name is <service>-<5 digits>. Rename it in the dashboard to anything you’ll recognise — models, registry, push. The hostname changes, so update your config after you rename.

A gateway name cannot be a wildcard, and cannot be the domain apex.

Troubleshooting

Everything returns 403 and the panel shows a quota bar at 100%. You’ve passed the plan’s rolling 30-day request or bandwidth ceiling. Only the gateway hostnames are blocked; usage ages out of the window on its own, or you can raise the ceiling with a plan change. See What Are Gateways?.

A docker pull or pip install starts, then fails partway. Check that you kept the required path — library/ for Docker Hub official images, /simple/ for PyPI. If the path is right and it still breaks, send us the failing command; a newly added preset may need another host on its allowlist.

The provider rejected my credentials or locked the account. Providers see gateway traffic arriving from shared nsin egress addresses. See Shared egress addresses.

The page says gateways aren’t on this domain’s plan. See Plans & Limits.

The Gateways page says the domain uses external DNS. A gateway is a record on your zone, so nsin has to be running your DNS. See Nameservers.