>
    Strata Copilot
    Deploy AI Gateway
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Gateway
    4. Deploy AI Gateway
    Download PDF
    Prisma AIRS

    Deploy AI Gateway

    Table of Contents

    Deploy AI Gateway

    Deploy AI Gateway in SaaS mode for fast setup with no infrastructure, or in Hybrid mode to keep LLM request and response payloads within your own.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Gateway (Americas region)
    • AI Gateway activated (see Activate AI Gateway)
    • Strata Cloud Manager access
    • Hybrid only: Kubernetes cluster with Helm installed
    After activation, AI Gateway can be deployed in two modes. In SaaS mode, Palo Alto Networks hosts the gateway data plane; your developers point their applications at the AI Gateway endpoint, and requests are routed to LLM providers through Palo Alto Networks infrastructure. In Hybrid mode, you host the data plane in your own Kubernetes cluster using a Helm chart downloaded from Strata Cloud Manager, so LLM payloads never leave your environment. Both modes are managed from the same Strata Cloud Manager interface, and you can run both simultaneously for different workloads.
    Select the deployment mode below.

    SaaS

    Enable AI Gateway in SaaS mode and create your first workspace to begin routing AI traffic through Palo Alto Networks infrastructure.
    The SaaS deployment model is enabled by default when you activate AI Gateway. Use this procedure to verify that SaaS mode is enabled and to create a workspace so your developers can start sending requests.
    1. In Strata Cloud Manager, select AI SecurityAI GatewaySettings.
    2. Verify that Enable AI Gateway is enabled and that the deployment type is set to SaaS.
      If AI Gateway is not enabled, enable it and click Save.
    3. Copy the endpoint URL displayed in the settings page.
      This is the URL your developers configure in their AI applications. It uses the format https://aigw.portkey.ai/v1/.
    4. Select AI SecurityAI GatewayWorkspaces and click Add Workspace.
    5. In Workspace Name, enter a name for the workspace, then click Save.
      The gateway automatically generates a virtual key for the workspace. Copy the virtual key from the workspace details panel — you will need it to authenticate requests. The key is only shown once.
    6. Click Commit to apply the configuration.
      The SaaS AI Gateway is enabled and your first workspace is ready. Developers can authenticate requests by including the virtual key in the x-portkey-virtual-key request header when calling the AI Gateway endpoint.

    Hybrid

    Deploy AI Gateway in Hybrid mode to keep LLM traffic within your environment by hosting the data plane on your own Kubernetes cluster.
    Hybrid deployment hosts the AI Gateway data plane on a Kubernetes cluster that you manage. LLM request and response payloads are processed within your environment and never transmitted to Palo Alto Networks. The management plane — workspace configuration, guardrail policies, and observability dashboards — continues to run in Strata Cloud Manager.
    Before you begin, ensure your Kubernetes cluster is provisioned and that Helm 3 is installed and configured to communicate with your cluster.
    1. In Strata Cloud Manager, select AI SecurityHome.
    2. On the AI Gateway tile, click Deploy Hybrid.
    3. In Name, enter a name for this Hybrid deployment instance, then click Next.
    4. Select the workspaces to associate with this Hybrid deployment, then click Next.
      You can associate all workspaces or select specific ones. Requests from selected workspaces will be routed through your on-premises data plane.
    5. Click Download values.yaml to save the Helm configuration file, then click Done.
      The values.yaml file contains your registration token and all configuration settings required for the Helm deployment. Keep this file secure.
    6. Add the AI Gateway Helm repository:
      helm repo add airs-gw https://portkey-ai.github.io/airs-gw-helm
helm repo update
    7. Install the AI Gateway chart using the downloaded configuration file:
      helm upgrade --install airs-gw airs-gw/airs-gw \
  -f ./values.yaml \
  -n airs-gw \
  --create-namespace
    8. Verify that the gateway pods are running:
      kubectl get pods -n airs-gw
      All pods should show a status of Running within a few minutes of installation.
    9. Confirm that the deployment shows as Connected in Strata Cloud Manager under AI SecurityAI GatewaySettings.
    10. Click Commit to apply the configuration.
      The Hybrid AI Gateway data plane is running in your Kubernetes cluster and connected to Strata Cloud Manager. LLM request and response payloads for the associated workspaces are processed within your environment.
      If the deployment does not show as Connected after 10 minutes, verify that your cluster has outbound connectivity to Strata Cloud Manager and that the registration token in values.yaml matches the one shown in Strata Cloud Manager.

    © 2026 Palo Alto Networks, Inc. All rights reserved.