Before you build a gateway for the OpenAI API, check whether a plain proxy already does what you need. This guide compares them and shows what each costs you.
Plain (forward) proxy: the SDK is configured with a proxy URL and still connects to api.openai.com, with the connection tunnelled through the proxy. You change the HTTP client, not the address. Our OpenAI API proxy guide shows the Python and Node settings.
Reverse proxy or gateway: you run a server at your own address, for example https://llm-gw.example.com/v1. The SDK is given that address as base_url (the Python SDK README also mentions the OPENAI_BASE_URL environment variable) and the gateway passes each request on to OpenAI.
| Item | Plain proxy | Gateway with base_url |
|---|---|---|
| What you want | A stable, known outbound IP for server calls | One place for keys, logging, rate limits or several services |
| What changes in the client | The HTTP client gets a proxy setting | base_url points to your server |
| Where the call reaches OpenAI from | The proxy's exit IP | The gateway server's IP |
| What you must run | Nothing beyond the proxy account | A server with TLS, updates and monitoring |
| What passes through | Encrypted traffic to api.openai.com | Your API key and every prompt, in the clear on the gateway |
Our comparison from the OpenAI SDK READMEs and the nginx documentation read on 15 November 2026. Choose by the problem you have, not by which sounds more advanced.
OpenAI says that using its services in countries or territories not on its supported list may get an account blocked or suspended, and the API answers 403 "Country, region, or territory not supported" when it sees a call from one. A gateway is not a way around that: the machine that actually calls OpenAI must be in a supported country, and so must you.
Never send your API key to a gateway you do not run or trust. Whoever operates it sees the key and every prompt and answer. A site that offers "free ChatGPT API proxy" is exactly that case.
If it is only "my server needs a fixed outbound IP", use a plain proxy and stop here. If it is "I need central keys and logs", continue.
Order an IP in a country OpenAI supports, set it on the HTTP client (see the code below and the OpenAI API proxy guide) and test with curl first.
Run the gateway on a server in a supported country, behind TLS. Give it a short timeout-safe configuration for streaming: no response buffering and a read timeout above your longest pause.
Set base_url (or baseURL in Node) to the gateway address including /v1. Keep the real OpenAI key on the gateway where you can, and give services their own gateway keys.
Call a model with stream enabled and check that chunks arrive as they are produced. Check what a bad key and a missing route return.
# Your own gateway, in a country OpenAI supports (nginx)
server {
listen 443 ssl;
server_name llm-gw.example.com;
# ssl_certificate and ssl_certificate_key go here
location /v1/ {
proxy_pass https://api.openai.com; # no URI part: /v1/... is passed on unchanged
proxy_ssl_server_name on; # send the server name (SNI) to the HTTPS target server
proxy_buffering off; # pass streamed chunks on as they arrive
proxy_read_timeout 300s; # default is 60s between two reads
}
}
Example only. The directives are from the nginx proxy module documentation; add certificates, access control and logging before use.
from openai import OpenAI, DefaultHttpx2Client
# A) Gateway: the client talks to YOUR URL; the gateway talks to api.openai.com
gateway = OpenAI(base_url="https://llm-gw.example.com/v1") # or set OPENAI_BASE_URL
# B) Plain proxy: the client still talks to api.openai.com, through a proxy
plain = OpenAI(http_client=DefaultHttpx2Client(proxy="http://USERNAME:PASSWORD@HOST:PORT"))
Example only. Replace the address and the proxy details with yours.
// npm install openai undici
import OpenAI from 'openai';
import { fetch, ProxyAgent } from 'undici';
// A) Gateway
const gateway = new OpenAI({ baseURL: 'https://llm-gw.example.com/v1' });
// B) Plain proxy
const dispatcher = new ProxyAgent('http://USERNAME:PASSWORD@HOST:PORT');
const plain = new OpenAI({ fetch, fetchOptions: { dispatcher } });
Example only. undici's fetch must be paired with its ProxyAgent, as the SDK documents.
Check OpenAI sees the call from an unsupported country. With a gateway that is the gateway server's IP; with a proxy it is the proxy's exit.
Fix Check the exit with https://ipinfo.io/json from the same machine, and move the gateway or choose an exit in a supported country.
Stop when Do not keep retrying from the same address.
Check The key was lost or changed on the way: the gateway does not pass the Authorization header, or two keys are mixed up.
Fix Check what the gateway sends to OpenAI and compare it with a direct curl call.
Stop when Revoke the key if it passed through a gateway you do not trust.
Check base_url misses /v1, or the gateway maps the path differently.
Fix Call the gateway with curl on /v1/models and compare with api.openai.com.
Stop when Fix the path mapping before testing from code.
Check The gateway buffers the response, or its read timeout is shorter than your longest pause. nginx buffers by default and waits 60s between reads.
Fix Turn buffering off and raise the read timeout on the gateway.
Stop when If it persists with a direct connection, the cause is elsewhere.
For server calls that need a stable outbound IP, a Proxy302 datacenter IP is the lighter option: HTTP or SOCKS5 chosen per IP at purchase, issued as host, port, username and password in My assets. A datacenter IP costs US$0.25 for one day and US$3.99 for 30 days, the same in every country, and is available in a limited list of countries shown on the order page. Auto-renew is optional and can be switched off in My assets. There is no free trial, and the smallest purchase is one IP for one day.
A proxy does not change OpenAI's terms. Use the API from a supported country and keep keys out of third-party gateways.
A server of your own that receives requests at your URL and forwards them to api.openai.com. Clients use it by setting base_url.
No. A plain proxy is set on the HTTP client and the client keeps using api.openai.com.
No. The call reaches OpenAI from the gateway's IP, and OpenAI answers 403 to unsupported countries and may block accounts that use its services from them.
Do not send your key to a gateway you do not control: its operator sees the key and all your prompts.
nginx buffers responses by default and waits 60s between reads. Turn buffering off and raise proxy_read_timeout for the streaming location.
Call the OpenAI API through a proxy: HTTPS_PROXY, the Python SDK’s HTTPX2 client, the Node SDK’s undici dispatcher, a curl test and SOCKS5 notes.
Call the OpenAI API from a supported country on a fixed datacenter IP: set it in the Python or Node SDK, and add the fixed address to OpenAI’s IP allowlist.
View options and pricingThe four official availability lists compared country by country — China, Hong Kong, Russia and more — plus hourly checks of the OpenAI and Anthropic APIs from 7 countries.
What a proxy MCP server is, how local and remote MCP servers differ, how to install one in Claude Code, Codex CLI and Cursor, and how to route the server's own traffic through a proxy.
Buy datacenter proxies by the IP: fast fixed IPs at the lowest price per address, billed per IP and term. HTTP or SOCKS5, choose the country.
View options and pricingProduct observation · Confirmed on:
Product facts file of the site (values checked against the console, the backend and the price table on 18-19 October 2026): prices in US$ (1 PTC = US$1), lease terms, protocols and ports, no free trial.
Official documentation · Confirmed on:
Read on 15 November 2026: the client takes a base_url and the README mentions the OPENAI_BASE_URL environment variable; the HTTP client can be overridden, for example DefaultHttpx2Client(proxy="http://...").
Official documentation · Confirmed on:
Read on 15 November 2026: the client takes a baseURL option; proxies are set with fetchOptions, for Node a dispatcher from undici's ProxyAgent, "paired with the matching fetch implementation".
Official documentation · Confirmed on:
Read on 15 November 2026: proxy_pass sets the protocol and address of a proxied server (http or https); proxy_buffering is on by default and when off the response is passed to the client as it is received; proxy_read_timeout defaults to 60s between two successive reads; proxy_ssl_server_name (default off) passes the server name through SNI to an HTTPS target server.
Official documentation · Confirmed on:
Read on 15 November 2026: 403 "Country, region, or territory not supported" means the API is being accessed from an unsupported country, region or territory; 401 means an invalid or incorrect API key.
Official documentation · Confirmed on:
Read on 15 November 2026: using the services in countries or territories not on the supported list "may result in your account being blocked or suspended."
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.
