Backmesh

What is Backmesh?

Backmesh is an open-source backend designed for AI applications on the Web and mobile devices; its main purpose is to prevent the private keys of LLMs such as OpenAI, Gemini, and Anthropic from being included in the client software. Developers can enable their applications to call these models through a secure gateway, while still being able to use the existing model SDKs.

It offers both official hosting services and Cloudflare’s self-hosted option. Backmesh is designed to address issues such as key security, user authentication, abuse prevention through rate limiting, and resource isolation; it is not a chatbot, a model training platform, nor a general-purpose agent builder.

Main functions of Backmesh

Hide LLM API keys

The private key of the model service is encrypted and stored by Backmesh; the client only sends the JWT of the logged-in user. This helps to reduce the risk of the key being leaked along with the application code, which could lead to abnormal billing.

JWT user authentication

The gateway verifies the JWTs issued by Supabase or Firebase to confirm that the request comes from a valid user within the application. Developers do not need to expose the private keys of the model services on the client side.

Set request limits based on user preferences

Developers can set a limit on the number of calls each user is allowed to make within a specified time window. Once this limit is exceeded, the gateway will return a 429 response; the application must provide clear instructions for retrying the request.

Resource access control

Backmesh can protect stateful API resources such as files and threads, allowing the users who created those resources to continue accessing their content. This mechanism helps to prevent unauthorized access to data by different end users.

Compatible with multiple model services

The official documentation lists OpenAI, Gemini, Anthropic, and Cloudflare Workers AI. The available endpoints, streaming responses, and file handling features should be tested individually within the target SDK.

Call analysis without additional SDKs

The managed console can automatically record model calls, enabling the monitoring of error rates, costs, response times, and the distribution of model usage. According to the official documentation, the self-managed version does not include the analysis dashboards available in the managed SaaS version.

Self-hosted deployment

The open-source version can be deployed on a personal Cloudflare account and run using Workers and KV. Those who opt for self-hosting are responsible for covering the costs associated with cloud resources, key management, logging, upgrades, and security maintenance.

Backmesh usage tutorial

1. Identify the identity system and LLM services to be used by the application, and outline the required API endpoints.
2. Register for a Backmesh hosting account, or deploy the open-source version in your Cloudflare account.
3. Create an LLM API Gatekeeper and enter the model interface address along with the private key.
4. Configure the parameters of the Supabase or Firebase project so that the gateway can verify JWTs.
5. Set reasonable time windows and request limits for individual users.
6. In the application, replace the model API address with the Backmesh gateway address.
7. Use the JWT of the currently logged-in user to send requests instead of the model’s private key.
8. Test abnormal scenarios such as invalid tokens, rate limits, file ownership, and stream output.
9. After going live, continuously monitor costs, error rates, latency, and abnormal calls.

Suggestions for connection

• First, verify the JWT signature, expiration time, and user identity in the test project.
• Set stricter per-user limits for expensive models and high-cost endpoints.
• Properly handle 401, 403, 429 errors as well as model service errors on the frontend.
• Do not store management passwords, Cloudflare keys, or model private keys in the client.
• Test the isolation of cross-user access for resources such as files, threads, and assistants.
• Regularly rotate the keys and check for abnormal traffic in the call logs.

Which users are it suitable for

• The JavaScript team responsible for developing AI applications for browsers.
• Developers who create mobile AI applications using Flutter or React Native.
• Projects that manage user login using Supabase or Firebase.
• Start-up teams that wish to reduce the risks of LLM key leaks and misuse of costs.
• Technical teams that need Cloudflare’s self-hosted AI gateway.
• SaaS products that enable the analysis of costs and performance based on end-users.

Advantages of Backmesh

• Centralize key protection, JWT authentication, rate limiting, and resource permissions in a single gateway.
• The application only requires replacing the base address and authentication token, with the changes related to integration being relatively limited.
• It supports multiple mainstream model services as well as two common identity providers.
• The open-source version allows teams to review the code and deploy it to their own Cloudflare account.
• The managed version offers automated analysis of user-level LLM calls.
• The pricing page shows the number of requests, the number of active users on a monthly basis, as well as the rules for overage billing.

Usage restrictions and precautions

• Backmesh cannot replace a comprehensive application security audit and protection for cloud accounts.
• The current official documentation focuses on supporting Supabase and Firebase; other authentication systems require separate verification.
• Self-hosting relies on Cloudflare Workers and KV, which incurs corresponding platform costs.
• The self-hosted version does not have an LLM analysis dashboard like the official SaaS version.
• The API costs associated with the model service itself are not included in the Backmesh subscription.
• If the throttling settings are too lenient, high billing costs for the model can still occur; if they are too strict, it will affect normal users.
• When dealing with files and threads, it is necessary to verify the resource isolation and data retention strategies.
• Open-source licensing requirements need to be evaluated in light of the actual methods of deployment and modification.

Price of Backmesh

The following are the prices for hosting services as published on the official website on August 26, 2026. The website offers a 15-day trial period; taxes, annual payment options, and corporate contracts may vary, and the final details shall be based on those shown on the settlement page or in the sales quotation.

All three tiers offer an unlimited number of LLM API Gatekeepers, dedicated Discord channels, as well as user-based rate limiting and resource access control. The term “unlimited” should still be interpreted in light of the service terms, rules for reasonable use, and the sales contract.

Instructions on open source and self-hosting

The Backmesh core repository is available on GitHub; it is primarily written in TypeScript and is licensed under the GNU Affero General Public License v3.0. It is a true open-source project, but using it, modifying it, or providing services over the network requires compliance with the requirements of AGPL-3.0.

The official self-hosted tutorial is based on Cloudflare Workers and KV, and it includes steps such as cloning code, creating KV namespaces, configuring environment variables, and deploying Workers. The analysis dashboards provided by hosted SaaS services do not fall within the scope of functions available in the self-hosted version.

Data and Security

The security benefits of Backmesh stem primarily from the server-side storage of model keys, the verification of JWT tokens, and the restriction of requests based on user credentials. The development team must still protect the identity system, Cloudflare accounts, backend passwords, and deployment environment variables.

Before going live, it is necessary to verify processes such as token expiration, user logout, access to resources across different users, log anonymization, and data deletion. No gateway can guarantee that the model will produce correct outputs, nor can it automatically meet all privacy or industry compliance requirements.

Frequently Asked Questions

Can Backmesh prevent the leakage of LLM keys?

It prevents the model’s private key from being placed directly in web or mobile clients, but developers still need to protect backend accounts, environment variables, and identity systems.

Which model services are supported by Backmesh?

The official documentation lists OpenAI, Gemini, Anthropic, and Cloudflare Workers AI; the compatibility of specific endpoints should be tested before integration.

Which user authentication systems is Backmesh compatible with?

The current official documentation explicitly supports Supabase and Firebase, and it verifies requests using user JWTs.

Can Backmesh be used for free?

The managed version offers a 15-day trial period, after which the Starter version costs $10 per month; the open-source version can be hosted locally, but it requires investment in Cloudflare resources and maintenance costs.

Can Backmesh be self-hosted?

Yes. The official documentation provides setup guides based on Cloudflare Workers and KV; the self-hosted version does not include analysis dashboards provided by hosted SaaS services.

Is Backmesh an open-source project?

Yes. The core repository is licensed under AGPL-3.0, and corresponding open-source obligations must be fulfilled when using or modifying it.