One endpoint can front several coding subscriptions
CLIProxyAPI accepts requests shaped for OpenAI, Gemini, or Claude and translates them for supported coding services. The README lists Codex, Claude Code, Gemini, Grok, Kimi, and compatible upstream providers. Streaming, tool calls, images, WebSockets, and multiple accounts are within scope. That makes it useful when one editor or agent should switch providers without carrying separate client integrations for each one.
The important distinction is how access works. Codex, Claude Code, Grok, and other documented paths can use OAuth logins tied to user accounts, while compatible upstreams can use API keys. CLIProxyAPI then presents its own downstream keys to clients and can rotate credentials with round-robin, weighted, or fill-first routing. This is more than a URL translator. It becomes the place where account files, retry behavior, and provider differences meet.
The 52-second install is the easy part
The code is Go, and our sandbox installed 153 packages in 52 seconds. Building commit a7e3596 succeeded in 155 seconds. The checkout held 1,373 files, about 407,384 source lines, and 16.7 MB before dependencies. Six CI workflow files, a Dockerfile, a Compose file, and a tests directory give operators several visible paths for inspecting how the project is assembled.
A working deployment still needs a copied configuration file and at least one provider account or key. The sample listens on port 8317 and binds every interface when host is empty. Set it to 127.0.0.1 for a machine-local gateway, or add a properly secured network boundary. Downstream clients need one of the configured API keys. The management API requires a separate secret even on localhost, and leaving that secret empty disables its routes.
What happened when we ran it
Our run installed in 52 seconds and built in 155 seconds, then the test command ended with exit code 1 after 154 seconds. Go reported 56 passed packages and 2 failed packages out of 58. The final lines showed successful SDK checks for plugin APIs, storage, proxy utilities, translators, and the repository test package before a plain overall FAIL.
That tail does not name either failed package or show an assertion, so it does not support a theory about the cause. The defensible result is simply that commit a7e3596 did not pass its full suite in a fresh Debian container with 3 CPUs and 8 GB of RAM. Anyone evaluating the project should reproduce the suite with complete logs and the exact providers, plugins, and client formats they intend to use.
Credentials and network exposure need deliberate limits
The authentication directory defaults to ~/.cli-proxy-api, which puts valuable OAuth material on the gateway host. File permissions, backups, log redaction, and access to that account should be treated as security controls. The sample configuration supports TLS, but leaves it disabled. It also supports SOCKS5, HTTP, and HTTPS upstream proxies, plus per-account overrides, which increases the number of routes where credentials and traffic can be misconfigured.
Remote management is off by default, a sensible choice. If enabled, it can manage a service that holds several accounts, so publishing port 8317 directly to a LAN or the internet is hard to justify. Standard Linux release archives support dynamic plugins and target GLIBC 2.17. Portable Linux and FreeBSD builds omit plugin support. Plugins run as trusted in-process code, so adding one should receive the same review as adding code to the gateway itself.
Protocol translation keeps changing under live clients
Release v7.2.143 was published on August 26, 2026, and included fixes for xAI namespace tools, Gemini schemas, Claude streamed tool indexes, and cached-token accounting. That release cadence is evidence of active maintenance. It is also a map of the workload: providers and clients change request shapes, tool formats, streaming events, and model metadata, while the proxy must keep each translation current.
Open issue 5262 provides a concrete client mismatch. A generated Codex catalog used reasoning values unsupported by an older Codex CLI, causing configuration loading to fail until the reporter upgraded. Other open reports discuss dropped output schemas and unsupported trailing assistant content. These are reports, not proof that every route is broken. They are enough reason to pin the proxy and client versions, then test every model and tool family used in production.
Built-in history ended with v6.10.0
CLIProxyAPI can aggregate in-memory usage, but the README says its built-in historical statistics were removed starting with v6.10.0. It points users to CPA Usage Keeper or CPA-Manager-Plus for persistence and dashboards. A team that needs request history, cost estimates, or account-pool reporting therefore operates another component and database, or exports the needed records through its own monitoring path.
GitHub showed 48,913 stars, 474 combined issues and pull requests, and a last push on August 26, 2026. Those figures describe a large, fast-moving community rather than a small settled utility. The proxy is attractive for an individual or team already juggling several coding subscriptions. Its failed suite, credential concentration, and continuing protocol fixes make version pinning and a private deployment part of the admission price.