Pangolin 1.22 Puts a Gateway in Front of Your Models

Most teams reached the same messy place at roughly the same time. Provider API keys are scattered across developer laptops, CI runners and half a dozen coding agents, nobody can say what a given month cost or which model a given service is actually calling, and rotating a key means hunting through config files. Pangolin 1.22, whose release notes are dated August 24, 2026 and which was written up more widely on August 30, answers that with a gateway resource: point your clients at one URL you control, keep the provider keys on the gateway, and get budgets and usage analytics for free. The same release moves browser based SSH, RDP and VNC out of the paid tier.

There is a version of this problem that predates models entirely. Every organisation eventually discovers that a credential scattered across twenty places is a credential nobody owns, and the fix has always been the same: put a proxy in the middle and make the proxy hold the secret. Pangolin 1.22 applies that shape to model traffic, which is currently the fastest growing pile of scattered API keys in most engineering teams.

What a gateway resource is

Pangolin is a self hosted tunnelled reverse proxy. You already use it to publish an internal service on a domain without opening ports. The 1.22 release adds a new kind of resource that speaks the model provider protocols instead of plain HTTP.

The mechanics are simple. A client, an application or a coding agent is configured with a Pangolin URL rather than an upstream endpoint. Pangolin identifies the caller, checks it against whatever rules apply, forwards the request to the matching upstream and hands back the response. The upstream credential never leaves the gateway. Callers authenticate with identity keys issued by Pangolin, which means revoking one client is a single action in one place rather than a hunt.

Because everything funnels through one point, three things become possible that were previously either impossible or a side project. Budgets can be set in dollars or in tokens, and enforced rather than merely reported. Usage analytics are per caller instead of per provider account, so you can answer which team or which service spent the money. Session history exists at all, though the release notes place session logs in the hosted and Enterprise tiers.

Mixing hosted and self hosted upstreams on one gateway

The provider list is broad on the hosted side: OpenAI, Anthropic, Google Gemini, Amazon Bedrock, Google Vertex AI, Microsoft Foundry, OpenRouter and Vercel AI Gateway. The part that matters more for anyone running their own infrastructure is that self hosted endpoints sit on the same footing. Ollama, vLLM, Bifrost and other compatible endpoints on your own machines attach to the same gateway resource as the commercial providers.

That combination is the interesting one. A single gateway can route cheap, high volume, privacy sensitive work to a local model you run yourself and send the rest upstream, with allow and block lists deciding which models are exposed through which gateway. The client does not need to know or care which side answered, which is exactly the property that makes it possible to change your mind later.

Public and private gateways are two different trust stories

A public gateway resource gets a domain name and authenticates callers with virtual API keys. That is what you need for anything you cannot install a client on: a hosted CI runner, a partner integration, a device outside your tunnel.

A private gateway resource is reachable only through the Pangolin client. The tunnel itself establishes who the caller is, so no separate key has to exist, which removes the credential rather than protecting it. For laptops and internal runners already enrolled in the tunnel, that is the cleaner arrangement and the one to prefer.

The part that costs nothing now

Browser based SSH, RDP and VNC arrived in Pangolin 1.19 as Enterprise features. In 1.22 they become public resources available in the Community Edition, joined by private SSH and HTTPS resources. For a self hoster that is a meaningful shift: reaching a console on an internal machine from a browser, without a jump host and without exposing a port, stops being a paid feature.

It also changes the calculus against the usual alternative, which is a mesh network and an SSH client on every device you might ever use. If you have been comparing approaches, our Tailscale and WireGuard comparison covers that side, and the SSH command cheatsheet still applies once you are through the browser console. A tunnelled reverse proxy and a mesh solve overlapping problems in genuinely different ways, and the right answer usually depends on whether the things reaching your infrastructure are machines you control or people you invite.

Smaller items round out the release. Public resources now display certificate validity status, so an expiring certificate is visible before it is an outage. Alert rules can send a test notification when you configure them, which is the feature every alerting system should ship with and most do not. Resource labels work through YAML blueprints or container labels, and there are logging table fixes.

Before you pull the images

The release notes specify minimum versions for the companion components, including the Traefik plugin and the tunnel component that private gateway resources rely on, and at least one of those has to be updated deliberately rather than arriving with the main upgrade. Check those numbers first. A gateway that starts cleanly but cannot serve private resources because a sidecar is a version behind is a genuinely annoying thing to diagnose, and it is entirely avoidable by reading two lines before running the upgrade.

Sources and further reading

• Pangolin 1.22: AI Gateway for Cloud and Self-Hosted Models, official release notes, dated August 24, 2026
• Pangolin 1.22 Tunneled Reverse Proxy Adds AI Gateway, Linuxiac, August 30, 2026
• Release 1.22.0, fosrl/pangolin on GitHub

Frequently asked questions