60s Pull the image · supply an APP_KEY · open the admin UI

Install in three commands.

The Community Edition is one container. No license key, no phone-home, no telemetry.

Coming soonComing soon Full quick-start ↗

DOCKER · ONE-LINER

Just run it.

Defaults to SQLite at /data/database.sqlite — perfect for a quick try-out. Swap to Postgres via env vars for production.

Coming soonComing soon

Then open http://localhost:8080

DOCKER COMPOSE

Production-ish in one file.

The compose file ships PromptGate alongside Postgres + a named volume for the data path. Set APP_KEY + DB_PASSWORD in a sibling .env and you're done.

Postgres 16 (recommended for production)
Separate named volumes for app data + DB
Stays under one network bridge — nothing extra exposed
Add a reverse proxy (Caddy / Traefik) in front for TLS

Compose docs ↗

docker-compose.yml yaml

services:
  promptgate:
    image: ghcr.io/promptgate-ai/promptgate:latest
    ports: ['8080:8080']
    environment:
      APP_KEY: ${APP_KEY}            # base64:... (generate once)
      DB_CONNECTION: pgsql
      DB_HOST: db
      DB_DATABASE: promptgate
      DB_USERNAME: promptgate
      DB_PASSWORD: ${DB_PASSWORD}
      PG_EDITION: community
    depends_on: [db]
    volumes: ['pg_data:/data']

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: promptgate
      POSTGRES_USER: promptgate
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes: ['db_data:/var/lib/postgresql/data']

volumes:
  pg_data:
  db_data:

Coming soonComing soon

ENVIRONMENT

What to set, what to leave alone

The defaults work for most setups. Override what your environment needs.

APP_KEY required

Laravel app key. Generate once: openssl rand -base64 32 → base64:<value>. Used for credential encryption.

APP_URL required

Public URL of your PromptGate instance. Used in OAuth callbacks + audit links.

DB_CONNECTION required

sqlite | pgsql | mysql. Postgres recommended for production.

PG_EDITION

community (default) | cloud. Drives log retention defaults.

SSRF_ALLOWED_HOSTS

Comma-separated allowlist for internal hosts the SSRF guard would otherwise block.

SESSION_ENCRYPT

true (default). Encrypts session cookies at rest.

SESSION_SECURE_COOKIE

true once you serve the admin UI over HTTPS.

FIRST RUN

Five-step onboarding

The dashboard surfaces these as a checklist; each step ticks itself off automatically as you complete it.

Create your first project. Pick a type — AI Gateway, AI Wrapper, Agent Proxy, API Gateway, or MCP Gateway. Type is fixed for the project's life.
Add a provider credential. Drop in your OpenAI / Anthropic / Mistral / … API key. Encrypted at rest with your APP_KEY.
Create your first endpoint. 7-tab wizard for AI Gateway endpoints; one-line for API Gateway proxies.
Issue an API token. Bearer token your client uses. Pick the narrowest scope (chat, models, proxy, mcp, tokens:write).
Send your first request. curl or open the Playground. The dashboard's "First request" step ticks once anything lands in gateway_logs.

Detailed first-run guide ↗

Stuck somewhere?

The docs are deeper. Or open an issue and we'll unblock you.

Documentation Coming soonComing soon Contact us