# Multi-Tenant Isolation: Key Groups, Header Rules, Per-Tenant Billing > AI gateway multi-tenant: key-group split, Header ACL to tell clients apart, per-tenant rate limit and billing, keys in memory only. Clear cost and permissions, tenant isolation by construction. Canonical: https://www.gatellm.io/use-cases/multi-tenant/ Key groups split models and load balancers, header rules tell clients apart, per-tenant rate limit and billing — multiple teams on one gateway, costs and permissions crystal clear. ## What the community actually complains about Reddit: "50 engineers, finance asks who spent the $400k." Multiple teams on one API key means no one can tell who spent what. Relays also mix all tenant keys together, let tenant data cross, and cannot rate-limit per tenant. ## How GateLLM does it GateLLM uses key groups to split models and load balancers — each tenant gets independent keys and quotas; header rules (Header ACL) tell clients apart by User-Agent / custom header for differentiated policy; per-tenant rate limit and billing are attributed independently. Tag each tenant key and you can also aggregate cost across tenants by tag. Under BYOK, keys live in memory only, so tenants are isolated by construction — never mixed, never exfiltrated. ## 5 levers that actually land - Key groups: split models and load balancers per tenant - Header rules (Header ACL): tell clients apart by User-Agent / custom header - Per-tenant rate limit: independent RPM / TPM / budget quotas - Per-tenant billing: independent cost attribution and invoicing - Keys in memory only: tenant isolation by construction, never mixed or exfiltrated ## FAQ ### How do multiple teams share one gateway and split costs? Key groups split per tenant — each tenant gets independent keys / quotas / billing with independent cost attribution; Header ACL differentiates clients for differentiated policy. ### Can keys leak between tenants? Under BYOK, keys live in memory only and key groups split them — tenants are isolated by construction, never mixed or exfiltrated. - [Full how-to: Multi-tenant isolation (docs)](https://docs.gatellm.io/en/usecases/multi-tenant-isolation) ## Related - [Home](https://www.gatellm.io/index.md) - [Pricing](https://www.gatellm.io/pricing.md) - [Cost Calculator](https://www.gatellm.io/calculator.md) - [About](https://www.gatellm.io/about.md) - [Book a Demo](https://www.gatellm.io/demo.md) - [FAQ](https://www.gatellm.io/faq.md) - [Compare AI Gateways](https://www.gatellm.io/compare.md) - [Compare LiteLLM](https://www.gatellm.io/compare/litellm.md) - [Compare OpenRouter](https://www.gatellm.io/compare/openrouter.md) - [Compare Alibaba Cloud AI Gateway](https://www.gatellm.io/compare/alibaba-cloud.md) - [Compare Azure API Management](https://www.gatellm.io/compare/azure-apim.md) - [Compare Apigee](https://www.gatellm.io/compare/apigee.md) - [Compare Cloudflare AI Gateway](https://www.gatellm.io/compare/cloudflare.md) - [Compare Kong AI Gateway](https://www.gatellm.io/compare/kong.md) - [Compare Portkey](https://www.gatellm.io/compare/portkey.md) - [LiteLLM vs Kong AI Gateway](https://www.gatellm.io/compare/litellm-vs-kong.md) - [LiteLLM vs OpenRouter](https://www.gatellm.io/compare/litellm-vs-openrouter.md) - [LiteLLM vs Portkey](https://www.gatellm.io/compare/litellm-vs-portkey.md) - [Use Cases](https://www.gatellm.io/use-cases.md) - [Reduce LLM Cost](https://www.gatellm.io/use-cases/reduce-cost.md) - [High Availability](https://www.gatellm.io/use-cases/high-availability.md) - [Compliance & Audit](https://www.gatellm.io/use-cases/compliance-audit.md) - [Troubleshooting by Symptom](https://www.gatellm.io/use-cases/troubleshooting.md) - [Mixed Multi-Vendor Model Stack](https://www.gatellm.io/use-cases/mixed-model-stack.md) - [Self-Host AI Inside Office](https://www.gatellm.io/use-cases/self-hosted-office-ai.md) - [Token Usage Visibility & Attribution](https://www.gatellm.io/use-cases/token-ops.md) - [Token FinOps: AI Cost Allocation & Control](https://www.gatellm.io/use-cases/token-finops.md) - [MCP Tool Governance](https://www.gatellm.io/use-cases/mcp-tool-governance.md) - [Web Search for Every Model](https://www.gatellm.io/use-cases/web-search-grounding.md) - [Multi-Key Rotation & Standby](https://www.gatellm.io/use-cases/multi-key-pooling.md) - [Admission Control for Connected Clients](https://www.gatellm.io/use-cases/client-admission-control.md) - [Enforce Which Model Agents Actually Run](https://www.gatellm.io/use-cases/enforce-model-policy.md) - [No Model Choice on the Client](https://www.gatellm.io/use-cases/automatic-model-tiering.md) - [One Protocol, Any Model](https://www.gatellm.io/use-cases/one-protocol-any-model.md) - [Office / Microsoft 365 Add-in](https://www.gatellm.io/office-addin.md) - [Glossary](https://www.gatellm.io/glossary.md) - [Model Catalog](https://www.gatellm.io/models.md) - [SDK & Framework Integrations](https://www.gatellm.io/integrations.md) - [AI Coding Agents & Harnesses](https://www.gatellm.io/coding-agents.md) - [Security & Compliance](https://www.gatellm.io/security.md) - [Privacy Policy](https://www.gatellm.io/privacy-policy.md) - [Terms of Service](https://www.gatellm.io/terms.md) - [Cookie Policy](https://www.gatellm.io/cookies.md) - [Data Processing Agreement (DPA)](https://www.gatellm.io/dpa.md) - [Sub-processor List](https://www.gatellm.io/subprocessors.md) - [Security Questionnaire (CAIQ/SIG/VSA)](https://www.gatellm.io/trust.md) - [Incident Response & Support](https://www.gatellm.io/sla.md) - [Vulnerability Disclosure Policy](https://www.gatellm.io/vulnerability-disclosure.md) - [Open Source License Notice](https://www.gatellm.io/open-source-licenses.md) - [Version Support & Lifecycle (EOL)](https://www.gatellm.io/lifecycle.md) - [Engineering Blog](https://www.gatellm.io/blog.md) - [Your Agents Have More Permissions Than Your Employees: Governing MCP Tools at the Gateway](https://www.gatellm.io/blog/mcp-tool-governance.md) - [The $10k Invoice Problem: Five Ways to Cut LLM Spend Without Dumbing Down Your App](https://www.gatellm.io/blog/reduce-cost.md) - [Your Vendor's List Price Is Not Your Cost: Applying Real FinOps to Token Spend](https://www.gatellm.io/blog/token-finops.md) - [llms.txt](https://www.gatellm.io/llms.txt)