xue-y-su/clove-api-1.0.6

Clove API is worth a look if you already operate a multi-provider LLM gateway and need compliance, attribution and public key-balance features on top of it; if you want a fresh, independently reviewed gateway, the evidence here is too thin to judge it.

The problem

An organisation wants one internal endpoint for OpenAI, Claude, Gemini and other upstream providers, with keys, users, quotas and spending tracked centrally. Normally that means either letting each team hold raw provider keys or assembling a gateway plus billing spreadsheets. With Clove, the administrator registers upstream channels and tokens in one console, and requests go through a single gateway that records usage and enforces limits. The user-visible change is that a developer requests a key from an admin instead of a provider, and can check remaining allowance on a public page.

What's different

Clove is built on New API v1.0.0-rc.21, and the README is explicit that the upstream release is merged in while Clove adds several features around it. The most distinctive is the public balance lookup: a /token-balance page and POST /api/token-balance endpoint let someone query remaining, used and restricted quota with just an API key, without logging in. That removes a common support loop for teams issuing keys to external users, but it also creates an unauthenticated surface, which the project says it mitigates with key masking, disabled caching and anonymous rate limiting.

The other additions are organisational rather than technical: a compliance-statement system with versioned statements, content hashes, checkbox and phrase confirmation, and a source-attribution system where admins define options and users record their source. Both can be made mandatory for token API access. For a gateway serving regulated or institutional users, these checks turn policy acknowledgement into an enforced step; for a casual self-hoster they are extra configuration, not core value. The project also keeps both Default (React) and Classic (Semi Design) frontends, so two UIs must be maintained and configured in parallel.

Who should try it

The good fit is an operator who already understands New API-style channel and token management, needs multi-model billing and quotas, and specifically needs compliance confirmations, source attribution or public balance checks. It also suits organisations that must keep the console and data on their own infrastructure. A poor fit is someone who only wants to call several providers from one key, or who wants a maintained-by-upstream, minimal gateway: the enhancements here are the reason to choose it, and the AGPL-3.0 obligations and operational surface are the cost. Someone evaluating it as a brand-new alternative should note that the project describes itself as an enhanced New API integration, so much of the behaviour is inherited rather than independently designed.

Requirements and limitations

Production deployment assumes Docker Compose, PostgreSQL, Redis and a trusted reverse proxy terminating HTTPS. A substantial set of secrets is mandatory before first start, including session, crypto, token HMAC and token encryption keys, and the README warns not to commit a filled .env.production. The deployment guide's backup, rollback and monitoring procedures are worth reading before going live, because the gateway holds credentials and billing data whose loss is disruptive.

Operationally, the project asks operators to ensure upstream keys, model services, payments, user data, content safety, filing, licensing, log retention and tax compliance themselves; those obligations do not disappear because the software provides a compliance checkbox. The compose defaults limit the database pool to 80 open connections, and the README notes that multi-node deployments need each node's limit reallocated against PostgreSQL max_connections. Finally, no license is declared in the repository metadata even though the README references AGPL-3.0, so confirm the actual licensing terms before redistributing.

HotRepo's take

HotRepo recorded 104 total stars and a #10 position on its NEW-REPOSITORY board (新项目榜, not the overall Trending board) on 2026-10-25, with the project only three days old. The board coverage spans 2026-10-24 to 2026-10-25 and provides no comparable daily history, so persistence of interest cannot yet be judged. Before adopting, verify the AGPL licensing claim against the repository and skim the deployment guide's recovery steps against your own backup plan.