Your gateway must:

  1. Serve HTTPS to your app. Ideally restrict it to your app as well (client certificates, Play Integrity, App Attest).
  2. Add X-API-KEY to every request, overwriting whatever the client sent.
  3. Send the device's real IP in X-XAI-Client-IP, overwriting whatever the client sent. The panel only trusts this header from registered gateways; without it, login IP blocking sees your gateway's IP.
  4. Talk to the panel over HTTPS and verify its certificate.
  5. Forward everything else unchanged: method, Authorization, body, status, and the response headers ETag, Retry-After, Cache-Control and If-None-Match on requests.
  6. Rate-limit by client IP. The panel blocks IPs with repeated failed logins, and your gateway shares one IP across all your users for anything the panel cannot attribute.

Minimal nginx configuration:

limit_req_zone $binary_remote_addr zone=xai_api:10m rate=10r/s;

server {
    listen 443 ssl;
    http2 on;
    server_name api.myapp.example;
    ssl_certificate     /etc/ssl/myapp/fullchain.pem;
    ssl_certificate_key /etc/ssl/myapp/privkey.pem;

    location /api/v2/ {
        limit_req zone=xai_api burst=40 nodelay;

        proxy_pass https://panel.example.com/api/v2/;
        proxy_ssl_server_name on;
        proxy_ssl_verify on;
        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        proxy_set_header Host panel.example.com;

        proxy_set_header X-API-KEY "YOUR_API_KEY";
        proxy_set_header X-XAI-Client-IP $remote_addr;
        proxy_set_header X-Forwarded-For "";
    }
}

Check it works:

curl -s https://api.myapp.example/api/v2/identity
# {"platform":"xtream-ai","version":"2.6","timestamp":1767225600,"capabilities":[...]}

If you get an HTML 404 instead of JSON, the panel does not recognize your gateway: the key is wrong, or your gateway's IP is not registered on it. A change made by the reseller takes up to 60 s to apply.