Sub2API

Sub2API is an open-source AI API gateway platform built in Go and Vue 3, designed to distribute and manage API quotas from AI product subscriptions. It lets operators pool multiple upstream AI accounts (Claude, OpenAI Codex, Gemini, Grok/xAI, Antigravity) behind a single endpoint and issue API keys to end users. The project is licensed under the GNU Lesser General Public License v3.0 and is actively maintained on GitHub, where it has accumulated over 29,000 stars as of mid-2026.

What It Is

Sub2API sits between end users and upstream AI providers, acting as a relay and quota-distribution layer. Administrators add upstream accounts (via OAuth or API key), and the platform generates API keys for users, tracks token-level usage, enforces concurrency and rate limits, and handles billing. It is self-hosted — operators deploy it on their own Linux servers or via Docker — and is aimed at developers, teams, and relay service operators who want to share or resell AI subscription capacity.

Core Architecture

The platform is built on a modern, containerizable stack:

• Backend: Go 1.25.7 with Gin and Ent ORM
• Frontend: Vue 3.4+, Vite 5+, TailwindCSS (embedded into the binary at build time)
• Database: PostgreSQL 15+
• Cache/Queue: Redis 7+

The gateway core handles intelligent account selection with sticky sessions, per-user and per-account concurrency controls, and configurable rate limiting. A built-in payment system supports EasyPay, Alipay, WeChat Pay, and Stripe for user self-service top-ups without a separate payment service.

Supported Upstream Providers

Sub2API supports a range of upstream AI services:

• Anthropic Claude — via OAuth subscription accounts; compatible with Claude Code CLI
• OpenAI Codex — forwarded as OpenAI-compatible Responses and Chat Completions traffic
• Google Gemini — via /v1beta/ endpoints
• Grok / xAI — via PKCE OAuth, supporting models like grok-4.3 and grok-build-0.1; routes /v1/responses, /v1/messages, and /v1/chat/completions to xAI
• Antigravity — dedicated endpoints at /antigravity/v1/messages (Claude) and /antigravity/v1beta/ (Gemini), with optional hybrid scheduling

Deployment Model

Three deployment paths are documented in the repository:

1. Script installation (recommended for Linux) — a one-click install.sh downloads pre-built binaries, installs to /opt/sub2api, and creates a systemd service. Upgrades are available directly from the admin dashboard.
2. Docker Compose — includes PostgreSQL and Redis containers; an automated docker-deploy.sh script generates secure credentials and creates data directories. A local-directory variant (docker-compose.local.yml) simplifies backup and migration.
3. Build from source — requires Go 1.21+, Node.js 18+, PostgreSQL, and Redis. The frontend is embedded into the Go binary using the -tags embed build flag.

A Simple Mode (RUN_MODE=simple) is available for individual developers or internal teams who want quick access without full SaaS billing features.

Update: v0.1.141

The latest release is v0.1.141, published on 2026-06-30, with the repository last pushed on 2026-07-01. The project has been under rapid development since its creation in December 2025, accumulating over 6,000 forks. Recent additions include built-in payment processing (previously a separate Sub2ApiPay project), Grok/xAI OAuth support with PKCE, Antigravity account integration, a mobile admin console companion app (sub2api-mobile built with Expo + React Native), and a growing ecosystem of community relay services built on top of the platform. The README notes that Sora-related features are temporarily unavailable due to upstream integration issues.

Tradeoffs and Compliance Risks

The README prominently warns that using Sub2API may violate the terms of service of Anthropic and other upstream providers. The project explicitly states it is provided for technical learning and research purposes only, and that all risks from use — including account bans and service interruptions — are borne solely by the user. Security configuration options include CORS allowlists, upstream URL allowlists, response header filtering, Cloudflare Turnstile support, and a circuit breaker for billing errors. HTTP upstream URLs are rejected by default and require explicit opt-in, which the documentation marks as insecure and unsuitable for production.