Four client protocols meet in one gateway
New API earns attention because it does more than rename provider URLs. One service accepts OpenAI Chat and Responses, Anthropic Messages, and Gemini requests, then routes them to configured upstream channels. The console manages users, model access, quotas, subscriptions, usage logs, and expression-based pricing. For a team already juggling 3 provider accounts, that is a coherent reason to run a gateway rather than scatter credentials through each application.
The scope also changes the risk. A conversion layer sits between your client and the billable upstream request, while the same system records usage and decides quota. The README warns that protocol-specific fields do not always map exactly. Open issue 7593 makes that warning concrete: on v1.0.0-rc.40, a reporter reproduced Anthropic tools reaching an OpenAI-compatible upstream in the wrong shape and receiving HTTP 400. Test the precise model, endpoint, streaming mode, and tool path you plan to sell.
The 286-second install was easy to start and slow to trust
The repository gives you a friendly first route: one Docker container, SQLite, a mounted data directory, and localhost port 3000. After the setup wizard, you add an upstream channel, enable models, configure pricing and quota, and issue a New API client credential. That gets a private trial moving without PostgreSQL or Redis. It does not prove that your chosen protocol conversion, retry policy, or accounting path behaves correctly.
Compose is the more realistic production starting point. Its default stack adds PostgreSQL and Redis, and the README tells you to replace example passwords and generate a persistent SESSION_SECRET. HTTPS deployments need secure cookies plus an exact trusted origin. Multi-node installs must share the database and effective cryptographic secret, while rate limits need shared Redis if you want them enforced across nodes. These are ordinary gateway duties, but none disappears behind the web console.
What happened when we ran it
Our sandbox installed commit c2b7a9a in 286 seconds, covering 846 Go packages in a fresh Debian container with 3 CPUs and 8 GB of RAM. The build then succeeded in 6 seconds. The checkout held 2,530 files, about 526,847 lines of source, and occupied 23.6 MB before that setup. This is a substantial codebase, yet compilation itself was the shortest part of our run.
The Go test step failed after 483 seconds. Of 89 packages, 84 passed and 5 failed. The supplied end of the log shows successful results for service, service/authz, and several setting packages, followed by FAIL. It does not identify the five failures or explain their causes, so blaming missing Debian packages or a specific subsystem would be guesswork. The useful finding is simply that commit c2b7a9a did not clear its complete Go test run in our sandbox.
We found 6 CI workflow files, a Dockerfile, and Compose configuration, but no tests directory. Go projects often keep tests beside the code, so that directory layout alone says little. The 84 passing packages show meaningful test coverage was exercised. The 5 failures still need to be reproduced and understood before this service gets authority over credentials, access, and usage charges.
Billing and access control make this an operator's product
New API includes channel priorities and weights, retries, multiple upstream credentials, user groups, API restrictions, passkeys, two-factor authentication, and session management. It can also account for cached tokens and different pricing tiers. That combination suits an internal platform team or a lawful API operator far better than a developer who only wants to proxy one model from a laptop.
Public operation brings a separate burden. The README places responsibility for upstream authorization, content safety, real-name rules, log retention, tax, and any required filings on the operator. Its AGPLv3 terms also add visible attribution and a link back to the original project for modified versions with a user interface. Read those conditions before changing the console or selling access, rather than treating licensing as a deployment detail after the fact.
September activity is high, and the queue is enormous
GitHub recorded 49,097 stars and a last push on September 28, 2026. Two days later, search showed 742 open issues and 618 open pull requests, matching the repository API's combined count of 1,360. That is evidence of a very active project and a heavy review burden at once. Recent reports include the protocol-conversion failure in issue 7593 and a restart problem after database migration in issue 7595.
The latest release we found, v1.0.0-rc.40, shipped on September 21. It raised task-plugin source uploads to 8 MiB, accepted more successful upstream task status codes, and fixed media handling in tool results. Frequent release work is reassuring, but the rc label and our 5 failed test packages argue for pinned versions, backups, and a staging replay of real traffic. Choose New API for the breadth of its operating console, then make every conversion and billing path earn production access.