Everything between a person and a model.
Janus Edge is an OpenAI-compatible gateway that gives IT the controls it needs and gives users a clear view of their own usage. Here's what comes in the box. Items marked Business or Enterprise need a paid license; everything else is free.
Identity and access
People sign in with the identity provider you already use, and nobody gets a model until you grant it.
Enterprise sign-in
Standard OIDC with Okta, Entra ID, Authentik, Keycloak or AD FS. Accounts are created the first time someone signs in, and their groups refresh from the token every time after that.
Explicit grants
Signing in doesn't grant anything on its own. Administrators give models to a person, a group, a team or everyone, and those grants add up. Display names keep provider renames out of users' way.
SCIM provisioning Business
Your identity provider pushes users, groups and teams to Janus. When someone is deprovisioned, their access and their tokens go with them immediately.
LDAP, local accounts and multiple IdPs Business
Bind to LDAP or Active Directory with group mapping, run several OIDC providers side by side, or use local accounts with TOTP for labs and break-glass access.
Self-service personal tokens
People create their own API tokens in the portal, limited to the models and teams they've been granted. Expiry, rotation and revocation each take one click, and administrators can see every token and who owns it.
Team service tokens
CI pipelines, agents and internal apps get their own identity instead of borrowing someone's personal key. Each token belongs to a team, has its own budget and model list, and shows up by name in reports and the audit log.
Policy rules
Block requests by user agent, header, IP address or forwarded-for chain, combined with AND, OR and NOT. Rules run before a request reaches a provider, so blocked traffic costs nothing.
Inspect model access by person, group, team, or service identity instead of sharing provider keys.
Actual Janus interface · Demo identities and synthetic usageModels and providers
One catalog and one API in front of every provider you use, with Janus handling the translation.
A curated catalog
Administrators decide which models exist, what they're called internally, who can use them and what they cost. New models stay hidden until someone enables them.
Every major provider
OpenAI, Anthropic, AWS Bedrock, Google Vertex, Ollama, Hugging Face TEI, and any OpenAI-compatible server such as vLLM, llama.cpp or LM Studio. Add an upstream, discover its models, and grant them.
Every kind of request
Chat, completions, embeddings, images, speech in both directions, Responses, Assistants, threads, files and moderation. Streams pass through without buffering, and file uploads are relayed byte for byte.
Protocol translation
Anthropic and Bedrock models are served through the OpenAI API, including tool calls, prompt caching and streaming, so clients don't need to change anything.
Aliases and fallbacks Business
Publish a name like chat-default, point it at any model, and change the target without touching a single client. If the target goes down, traffic falls back automatically.
Health checks and discovery
Janus probes each upstream and discovers its models along with context windows and prices. Health badges reflect real traffic, not just a ping.
Large requests handled properly
Bodies up to 32 MB are inspected for routing and anything larger is relayed as-is. If a provider adapter would have to rewrite an oversized body, Janus refuses with a clear 413 instead of quietly truncating it.
Review model status, provider, pricing, context windows, and grants across your upstreams.
Actual Janus interface · Demo identities and synthetic usageCost and reporting
Usage numbers that match your provider's invoice, broken down however finance wants to see them.
Metering that matches the invoice
Input, output, cached and cache-write tokens (with five-minute and one-hour writes priced separately), plus latency, time to first byte, modality, finish reason, status and source IP for every request.
Rate cards with history
Prices are discovered from providers where they're published, and you can edit them per model with an audit trail. Past requests keep the rate that applied when they ran.
Quotas and budgets
Cap input tokens, output tokens, spend or request count over calendar or rolling windows, per person or team and optionally per model. People are warned at 80% and 95%, and a refusal always says when the limit resets.
Usage by team
Roll costs up by team or department for chargeback, compare spend across models, and spot a runaway script before the invoice does.
Dashboards for everyone
Personal, team, organization and admin views. The People page filters by group, team, role and status, and every filter lives in the URL so you can share a view.
Reports and exports
Built-in cost, usage and adoption reports with CSV export. On Business, schedule them by email, pull them from the API, and export the audit log.
Prompts stay private
Janus keeps request metadata only. Request bodies are captured only during an explicit, time-limited, filtered troubleshooting session, can be encrypted at rest, and can be purged with one button.
Compare periods, explore model and user mix, and export a frozen result to CSV, XLSX, PDF, or JSON.
Actual Janus interface · Demo identities and synthetic usage
Track utilization, reset times, and breach behavior for individual and team limits.
Actual Janus interface · Demo identities and synthetic usage
Compare team activity and recorded cost, with the underlying report data available for review.
Actual Janus interface · Demo identities and synthetic usageSecurity
Checks that run on the traffic itself, before anything sensitive reaches a provider.
Prompt-injection detection
Run Prompt Guard 2, or any text classifier served by TEI, on incoming requests. Community lets you observe the results; Business can block, redact or flag.
Content safety
Llama Guard 4 on vLLM classifies both requests and responses against the S1–S14 hazard categories, and response checks work on streamed output too.
Secret redaction and blocking
Built-in detectors catch passwords, API keys, cloud credentials and tokens in prompts. For each rule you choose whether to redact the secret before the request leaves your network or to block the request and tell the user why.
Audit log
An append-only record of every administrative action and policy decision. Export it to your SIEM on Business.
Troubleshooting captures Business
Capture request bodies for a limited window using include, require and exclude filters, then download a tar.gz with a JSONL index ready for Athena or DuckDB.
Alerting Business
Email and webhook alerts for quota breaches, provider failures, replication lag and spikes in guardrail activity, with Prometheus alert rules included.
Filter historical findings by policy, detector, severity, and action. Investigate without exposing prompt contents.
Actual Janus interface · Demo identities and synthetic usageOperations
Built to be run by the team that already runs your infrastructure.
A single binary
A Go backend with the admin interface built in. On a Linux server, one command installs it as a system service with HTTPS and your choice of certificate. It also ships as a Helm chart, a Docker image and a Compose example. The installation guide covers prerequisites.
SQLite or PostgreSQL
Use the built-in SQLite to evaluate and PostgreSQL in production. Migrations are versioned; back up the database with your usual tools and keep the encryption key safe. See the backup and restore guide.
High availability Business
Run several stateless replicas behind your load balancer, all sharing one database. Plan database availability and workload placement to suit your environment.
Observability
Prometheus metrics, structured JSON logs, OTLP traces, and /healthz and /readyz probes that ride out a brief identity-provider hiccup.
Air-gap ready Enterprise
Offline Linux archives and signed license files. Setting JANUS_OFFLINE=true turns off update checks and license sync while your configured providers keep working. See offline installation.
Source available
Read and audit every line under the Elastic License 2.0. Release images are built from the published tag.
Organization-wide usage, spend, model review, and team activity in one administrative view.
Actual Janus interface · Demo identities and synthetic usageSee it on your own network.
The Community edition is free for up to 25 people, and a first request usually goes through in about ten minutes.