Sourcegraph Cody Gateway powers the default "provider": "sourcegraph" Cody completions and embeddings for Sourcegraph Enterprise customers on Sourcegraph 5.1 or later, both on-prem and in Sourcegraph Cloud. It supports a variety of upstream LLM providers, such as Anthropic and OpenAI, with rate limits, quotas, and model availability tied to Sourcegraph Enterprise product subscriptions.

In general, we have two Cody Gateway deployments running:

[!NOTE] This page primarily contains operational and development information for Cody Gateway. To learn more about using Cody Gateway, see Using Cody Gateway , or refer to the customer-facing Sourcegraph Cody Gateway docs.

If you need any assistance, please reach out to #wg-cody-gateway.

Architecture

Actor sources

Cody Gateway’s primary responsibility is access control to upstream LLM services (both off-the-shelf accounts owned by Sourcegraph, and more recently, self-hosted models and the like). It does this through a mechanism internally dubbed “actor source sync”, where:

  1. “Actor” is the identity of some entity trying to use Cody Gateway. Each “actor” is designated some amount of access to various features (completions, embeddings, etc) through their “source”, and Cody Gateway enforces the designated access.
  2. "Source” is the where the actor comes from. We have two sources today:
    1. Enterprise subscriptions, owned by Core Services team
    2. Self-Serve Cody PLG users, owned by Cody Prime
  3. “Sync” via a pull model (where Cody Gateway asks for information from sources about the actors they know about). Depending on the “source” implementation, this can either be per-actor on cache miss, or whole-world (sync all known actors for a particular source)

As such, accessing Cody Gateway happens through two very distinct mechanisms:

  1. Enterprise customers access Cody Gateway as a single actor representing their Sourcegraph instance as a whole. These are synchronised from Sourcegraph Enterprise Portal (EP) . Instances access Cody Gateway using an “access token” generated from their current license key - see Using Cody Gateway. For help around Enterprise customer access to Cody Gateway, please reach out to Core Services team.
    1. Note that License keys do not configure Cody Gateway access in an offline manner. ****They are only used to map an “access token” to the correct Enterprise subscription, and infer defaults; all access is configured in the Enterprise Portal service. This also means that all customers must be correctly set up with 1 instance per subscription, based on Enterprise Subscription modelling in Enterprise Portal.
    2. Note that instances do not need to designated an access token explicitly; they just need to leave it un-set, and it will infer the appropriate access token from the configured license key. See Using Cody Gateway.
    3. For legacy reasons, in-code, this is referred to as dotcom-product-subscriptions.
  2. Self-Serve Cody PLG users access Cody Gateway as an actor representing their specific SAMS user. In-code, this is referred to as dotcom-users. For help around PLG user access to Cody Gateway, please reach out to Cody Prime

The source code for actors and actor sources lives in cmd/cody-gateway/internal/actor/actor.go.

API handlers

Cody Gateway implements pass-through API handlers for various upstream services in cmd/cody-gateway/internal/httpapi/handler.go