llm-proxy-admin Architecture

llm-proxy-admin Architecture An architecture diagram generated by Archify. Admin Browser · SPA & SSE Streaming · Architecture component Admin Browser SPA & SSE Streaming Google Identity · OIDC & OAuth2 PKCE · Architecture component Google Identity OIDC & OAuth2 PKCE Ingress & Guard · Auth, Session & CSRF · llm-proxy-admin Runtime (:8080) · RBAC + Allowlist Ingress & Guard Auth, Session & CSRF RBAC + Allowlist Admin Gateway · CRUD, Playground, Judge · llm-proxy-admin Runtime (:8080) Admin Gateway CRUD, Playground, Judge Analytics Engine · Cost & Efficiency Scoring · llm-proxy-admin Runtime (:8080) Analytics Engine Cost & Efficiency Scoring llm-proxy · Admin & Data gRPC (:9090) · Architecture component · Bearer admin_key llm-proxy Admin & Data gRPC (:9090) Bearer admin_key light-tokenmeter · HTTP Usage API (:8080) · Architecture component · /readyz probe light-tokenmeter HTTP Usage API (:8080) /readyz probe OIDC & PKCE /auth/callback HTTPS / UI & API Authorized /api/* /api/usage Admin & Data gRPC Summary & /readyz llm-proxy-admin Runtime (:8080) Legend Backend Cloud Security External

Authentication & Guard

  • • Google OAuth2 with PKCE, state & nonce; session stored in signed encrypted cookie
  • • Two-tier RBAC: admin (full mutations) and viewer (read-only) evaluated per request
  • • Strict CSRF protection via X-Requested-With header, SameSite cookies, and CSP

Dual-Backend Console

  • • llm-proxy gRPC: live model/rule mutations, token rotation, streaming playground, and Judge
  • • light-tokenmeter HTTP: daily token aggregations, cost breakdown, and readiness probe
  • • In-memory analytics calculates 'Greedy' vs 'Worthy' usage efficiency verdicts