Client request
    │
    ▼
┌───────────────────────────────────┐
│  API GATEWAY                      │
│  ├── Authentication (who are you?)│
│  ├── Rate limiting (slow down!)   │
│  ├── Usage tracking (logging)     │
│  ├── Request routing (which API?) │
│  ├── Response caching (faster!)   │
│  └── Billing (how much to charge) │
└───────────────┬───────────────────┘
                │
    ┌───────────┼───────────┐
    ▼           ▼           ▼
  LLM API    Image API   Voice API

# auth.py
import sqlite3
import hashlib
import secrets
from fastapi import HTTPException, Security
from fastapi.security import APIKeyHeader

api_key_header = APIKeyHeader(name="X-API-Key")

def hash_key(key: str) -> str:
    return hashlib.sha256(key.encode()).hexdigest()

def create_api_key(label: str, tier: str = "free") -> str:
    key = f"sk-{secrets.token_hex(24)}"

    conn = sqlite3.connect("api_keys.db")
    conn.execute("""
        INSERT INTO api_keys (key_hash, label, tier, created_at)
        VALUES (?, ?, ?, datetime('now'))
    """, (hash_key(key), label, tier))
    conn.commit()
    conn.close()

    return key  # Only returned once — client must save it

async def validate_key(key: str = Security(api_key_header)) -> dict:
    conn = sqlite3.connect("api_keys.db")
    row = conn.execute(
        "SELECT label, tier, is_active FROM api_keys WHERE key_hash = ?",
        (hash_key(key),)
    ).fetchone()
    conn.close()

    if not row:
        raise HTTPException(status_code=401, detail="Invalid API key")
    if not row[2]:
        raise HTTPException(status_code=403, detail="API key disabled")

    return {"label": row[0], "tier": row[1]}

from auth import validate_key

@app.post("/v1/chat")
async def chat(request: ChatRequest, api_key: dict = Security(validate_key)):
    # api_key contains {"label": "acme-corp", "tier": "pro"}
    # Use tier to set limits
    max_tokens = 4096 if api_key["tier"] == "pro" else 512
    # ... process request

# rate_limiter.py
import time
from collections import defaultdict

class RateLimiter:
    def __init__(self):
        self.requests = defaultdict(list)

    TIER_LIMITS = {
        "free":  {"rpm": 10,  "rpd": 100,  "tokens_per_day": 10000},
        "basic": {"rpm": 60,  "rpd": 1000, "tokens_per_day": 100000},
        "pro":   {"rpm": 300, "rpd": 10000,"tokens_per_day": 1000000},
    }

    def check(self, key_hash: str, tier: str) -> bool:
        now = time.time()
        limits = self.TIER_LIMITS[tier]

        # Clean old entries
        self.requests[key_hash] = [
            t for t in self.requests[key_hash] if now - t < 86400
        ]

        # Check requests per minute
        recent_minute = [t for t in self.requests[key_hash] if now - t < 60]
        if len(recent_minute) >= limits["rpm"]:
            return False

        # Check requests per day
        if len(self.requests[key_hash]) >= limits["rpd"]:
            return False

        self.requests[key_hash].append(now)
        return True

from fastapi import Response

@app.post("/v1/chat")
async def chat(request: ChatRequest, response: Response,
               api_key: dict = Security(validate_key)):

    remaining = rate_limiter.get_remaining(api_key["key_hash"])
    response.headers["X-RateLimit-Limit"] = str(remaining["limit"])
    response.headers["X-RateLimit-Remaining"] = str(remaining["remaining"])
    response.headers["X-RateLimit-Reset"] = str(remaining["reset_at"])

    # ... process request

# usage.py
import sqlite3
from datetime import datetime

def log_usage(key_hash: str, endpoint: str, tokens_in: int,
              tokens_out: int, latency_ms: float):
    conn = sqlite3.connect("usage.db")
    conn.execute("""
        INSERT INTO usage_logs
        (key_hash, endpoint, tokens_in, tokens_out, latency_ms, timestamp)
        VALUES (?, ?, ?, ?, ?, ?)
    """, (key_hash, endpoint, tokens_in, tokens_out, latency_ms,
          datetime.utcnow().isoformat()))
    conn.commit()
    conn.close()

def get_usage_summary(key_hash: str, period: str = "month") -> dict:
    conn = sqlite3.connect("usage.db")
    row = conn.execute("""
        SELECT COUNT(*), SUM(tokens_in), SUM(tokens_out)
        FROM usage_logs
        WHERE key_hash = ? AND timestamp > datetime('now', '-1 month')
    """, (key_hash,)).fetchone()
    conn.close()

    return {
        "total_requests": row[0],
        "total_tokens_in": row[1] or 0,
        "total_tokens_out": row[2] or 0,
        "estimated_cost": calculate_cost(row[1] or 0, row[2] or 0)
    }

@app.get("/v1/usage")
async def get_usage(api_key: dict = Security(validate_key)):
    return get_usage_summary(api_key["key_hash"])

┌─────────────────────────────────────────────────┐
│  FREE TIER — PKR 0/month                        │
│  ├── 100 requests/day                           │
│  ├── 10,000 tokens/day                          │
│  ├── 10 RPM                                     │
│  └── Community support only                     │
├─────────────────────────────────────────────────┤
│  STARTER — PKR 5,000/month ($18)                │
│  ├── 1,000 requests/day                         │
│  ├── 100,000 tokens/day                         │
│  ├── 60 RPM                                     │
│  └── Email support                              │
├─────────────────────────────────────────────────┤
│  PRO — PKR 25,000/month ($90)                   │
│  ├── 10,000 requests/day                        │
│  ├── 1,000,000 tokens/day                       │
│  ├── 300 RPM                                    │
│  ├── Priority support                           │
│  └── Custom model fine-tuning                   │
├─────────────────────────────────────────────────┤
│  ENTERPRISE — Custom pricing                    │
│  ├── Unlimited requests                         │
│  ├── Dedicated GPU instances                    │
│  ├── SLA guarantee (99.9%)                      │
│  └── On-premise deployment option               │
└─────────────────────────────────────────────────┘