Speko Gateway
The open-source, customer-side runtime for real-time voice AI.
The Speko Gateway is an MIT-licensed sidecar binary (spekoai/gateway on Docker Hub, source at github.com/SpekoAI/gateway) that runs inside your infrastructure, next to your agent. It gives your agent one local streaming protocol across voice providers, keeps BYOK credentials inside your process, and can optionally use Speko for managed routing, observability, and consolidated billing.
Early preview: the protocol is versioned, but breaking changes may occur before the first stable release.
What makes it different
- No network surface. The gateway serves its API only on an owner-only Unix socket (
/run/speko/runtime.sockby default). It opens no TCP port; the container exposes none. - Provider traffic is direct. Audio and text flow straight from your process to the provider — never through Speko — on provider-direct routes.
- Verified execution plans. Every session is authorized by a signed plan the gateway verifies before attaching credentials or media. Managed plans come from Speko's control plane; BYOK plans are minted and HMAC-signed in-process.
- One protocol, many providers. Installed STT/TTS adapters share one session API and WebSocket stream. The local
GET /v1/modelsresponse is authoritative for each build.
Request-scoped credential sources
| BYOK request | Speko-managed request | |
|---|---|---|
| Selection | credential_source: "byok" | credential_source: "managed" |
| Provider credential | yours, never leaves the process | short-lived, delegated per session |
| Routing | you name the provider | Speko picks per request (provider: "auto") |
| Billing | your provider bills you | consolidated on your Speko invoice |
| Speko account | not required | required |
Both request types can coexist in one process. The LiveKit integration's credential_source="auto" selects managed when SPEKO_API_KEY or SPEKO_API_KEY_FILE is configured, and BYOK otherwise. Details in Modes.
The local API at a glance
| Route | Purpose |
|---|---|
GET /healthz, GET /readyz | liveness and drain state (unauthenticated) |
GET /v1/models | which adapters this build ships (unauthenticated) |
POST /v1/sessions | create a provider session |
GET /v1/sessions/{id}/stream | the canonical WebSocket for audio and events |
DELETE /v1/sessions/{id} | abort a session |
GET /metrics | Prometheus metrics (authenticated) |
All authenticated routes take Authorization: Bearer <SPEKO_LOCAL_AUTH_TOKEN>.
Start with the quickstart.