For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Serve the UI on a gateway
Give the UI a gateway of its own so that UI traffic and proxy traffic do not share a port.
Verified Code examples on this page have been automatically tested and verified.About
A generated configuration attaches the UI to the same default gateway that serves your proxy traffic. Giving the UI a gateway of its own keeps UI traffic and proxy traffic on separate ports. Separate ports let you publish the proxy port while the UI port stays internal, and they let you apply different authentication policies to each.
A gateway of its own is also the prerequisite for the next two guides, because an authentication policy in ui.policies applies to the gateway that serves the UI, and a TLS certificate is configured on that gateway.
Before you begin
- Install standalone agentgateway.
- Launch the UI so that you know where agentgateway serves it today.
Serve the UI on its own gateway
Add a second gateway to your configuration and point the ui section at it. The configuration is the same in every installation method, because all three read the same file. What differs is how you deliver the file to the proxy.
Add a gateway for the UI to your configuration file, and point the
uisection at it. The following example serves proxy traffic on port4000of thedefaultgateway and the UI on port4001of theui-gateway.# yaml-language-server: $schema=https://agentgateway.dev/schema/config gateways: default: port: 4000 ui-gateway: port: 4001 ui: gateways: [ui-gateway] routes: - matches: - path: pathPrefix: / backends: - host: httpbin.org:80Start agentgateway with the updated configuration.
agentgateway -f config.yamlAgentgateway logs the UI gateway address.
INFO app serving UI at http://localhost:4001/uiConfirm that the UI answers on its own port.
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4001/uiExample output:
200Confirm that the UI no longer answers on the proxy port. The response code depends on what your route does with the
/uipath. In this example, the request reaches httpbin, which returns a404.curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4000/uiExample output:
404
Note
The UI gateway is an addition, not a replacement. Agentgateway still serves a copy of the UI on the admin interface, which is loopback-only and which you do not need to change. Adding this gateway does not put the admin interface’s debugging endpoints on it. For more information, see The UI and the admin interface are not the same thing.
Next steps
- Secure the UI with an OIDC login on the gateway that you created.
- Expose the UI on your own HTTPS hostname.