---
title: "Streaming API v2: Run a gateway"
description: "Set up the small reverse proxy that holds the API key and forwards your app to the panel, with a minimal nginx configuration."
---

Your gateway must:

1. Serve **HTTPS** to your app. Ideally restrict it to your app as well
   (client certificates, Play Integrity, App Attest).
2. **Add `X-API-KEY`** to every request, overwriting whatever the client sent.
3. **Send the device's real IP** in `X-XAI-Client-IP`, overwriting whatever
   the client sent. The panel only trusts this header from registered
   gateways; without it, login IP blocking sees your gateway's IP.
4. Talk to the panel over **HTTPS and verify its certificate**.
5. Forward everything else unchanged: method, `Authorization`, body, status,
   and the response headers `ETag`, `Retry-After`, `Cache-Control` and
   `If-None-Match` on requests.
6. Rate-limit by client IP. The panel blocks IPs with repeated failed logins,
   and your gateway shares one IP across all your users for anything the
   panel cannot attribute.

Minimal nginx configuration:

```nginx
limit_req_zone $binary_remote_addr zone=xai_api:10m rate=10r/s;

server {
    listen 443 ssl;
    http2 on;
    server_name api.myapp.example;
    ssl_certificate     /etc/ssl/myapp/fullchain.pem;
    ssl_certificate_key /etc/ssl/myapp/privkey.pem;

    location /api/v2/ {
        limit_req zone=xai_api burst=40 nodelay;

        proxy_pass https://panel.example.com/api/v2/;
        proxy_ssl_server_name on;
        proxy_ssl_verify on;
        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        proxy_set_header Host panel.example.com;

        proxy_set_header X-API-KEY "YOUR_API_KEY";
        proxy_set_header X-XAI-Client-IP $remote_addr;
        proxy_set_header X-Forwarded-For "";
    }
}
```

Check it works:

```sh
curl -s https://api.myapp.example/api/v2/identity
# {"platform":"xtream-ai","version":"2.6","timestamp":1767225600,"capabilities":[...]}
```

If you get an **HTML 404 instead of JSON**, the panel does not recognize your
gateway: the key is wrong, or your gateway's IP is not registered on it. A
change made by the reseller takes up to 60 s to apply.