Frequently Asked Questions

Behest is the enterprise AI Token FinOps platform — the control center for your AI costs. It sits between your apps and your AI providers to track, attribute, and enforce token spend at the unit level, with AI governance (PII redaction, prompt-injection defense, model allowlists) and an AI Backend built in. One control center that stops shadow AI and runaway token costs.

An AI Backend as a Service is the complete infrastructure layer between your application and your LLM provider. Instead of building and maintaining authentication, CORS proxies, PII protection, rate limiting, conversation memory, and observability yourself, you get all of it out of the box with a single API integration. It allows frontend developers to build secure AI apps without writing backend code.

Point your frontend directly at your Behest project URL. Behest handles CORS natively, so your browser-based app can call the AI API without a backend proxy. Sign up at behest.ai/dashboard, create a project, configure your allowed origins, and make standard fetch calls from your React, Vue, Svelte, or vanilla JS frontend. No server code required.

Hours, not months. Sign up at behest.ai/dashboard, create a project, copy your API key, and point your frontend at your project URL. The entire AI backend — auth, CORS, PII scrubbing, prompt defense, rate limiting, memory, and observability — is live immediately.

No. Behest uses an OpenAI-compatible REST API. Any HTTP client works — fetch, axios, requests, curl, or any language that can make HTTP POST requests. There is no proprietary SDK to learn or maintain.

AI FinOps is a broad term that often just means looking at your monthly cloud bill to see how much you spent on AI infrastructure. AI Token FinOps is the specific, operational practice of managing AI costs at the unit level (the token). While AI FinOps might tell you that you spent $50,000 on OpenAI last month, AI Token FinOps tells you exactly which user, in which project, during which session spent those tokens—and allows you to enforce hard budgets before the spend even happens. AI Token FinOps is the complete, proactive solution for AI unit economics.

AI Token FinOps is the control center for your AI spend: tracking, allocating, and controlling AI Token budget at the unit level. It brings the rigor companies already apply to cloud costs (attribution, budgets, forecasting) down to every model call, so AI cost becomes visible and predictable before the invoice arrives. Behest attributes every dollar to specific users, projects, and sessions so CFOs and platform teams can plan, forecast, and enforce budgets.

Unlike basic observability tools that only report costs after the fact, Behest sits in the request path. You can set hard token or dollar budgets per project, user, or department. If a request would exceed the budget, Behest blocks it instantly—preventing runaway costs before they hit your OpenAI or Anthropic invoice.

Behest's BYOAK v2 (Bring Your Own API Key) allows you to securely store provider keys per tenant or department. When a department makes an LLM request, it routes through their specific provider account. This means the actual LLM invoice from OpenAI or Google goes directly to that department, providing perfect billing isolation and eliminating the need for complex internal chargeback accounting.

Rarely one line item — it is usually several compounding causes. Unbounded retries and agentic, multi-step loops fan a single task out into many model calls. Reasoning models burn far more tokens per answer. Duplicate or 'try again' calls pile up unnoticed. The root cause is that most teams have no per-team, per-user, or per-session attribution, so nobody can see who spent what — and shadow AI (tools IT never sanctioned) adds spend you cannot even see. Behest's AI Token FinOps control center attributes every model call to an owner and enforces hard budgets on the request path, so runaway spend is caught before the provider invoice arrives.

Attribute every model call as it happens. Behest meters each request on the path — model, tokens, and cost — and tags it to a user, project, session, and cost center, so spend rolls up per team instead of arriving as one opaque provider invoice. From there you get chargeback-ready showback views that mirror how finance already reports shared platform spend, plus per-team budgets and forecasts. Because attribution is captured in the request path rather than reconstructed from logs at month-end, the numbers are accurate in real time — this is the core of AI Token FinOps.

Yes — that is the point of Behest's AI Token FinOps control center. Attribution, budgets, and enforcement are built into the platform, so a platform, finance, or engineering owner gets them out of the box without standing up a dedicated FinOps function or hiring a FinOps analyst. Every model call is attributed to a user, project, and session, hard budgets block overruns on the request path, and chargeback-ready exports plug into your existing finance reporting — all self-serve, in our cloud or yours.

Yes — two ways. Attribution and hard budgets stop waste and overruns before the invoice arrives, and smart routing sends each request to the cheapest model that meets your quality bar — up to ~30% lower AI costs, depending on use case. And because Behest is a flat SaaS license rather than a percentage of spend, the savings stay yours.

Behest provides the technical controls required by emerging AI regulations. This includes immutable audit trails of all AI interactions, model allowlists to prevent the use of unapproved shadow IT models, and built-in guardrails (PII redaction and prompt injection defense) that map directly to NIST AI RMF risk management requirements.

Model allowlists let administrators strictly define which LLMs can be used by which applications or departments. If a developer tries to call an unapproved model (e.g., an experimental model that hasn't passed legal review), Behest blocks the request at the gateway level, ensuring enterprise-wide policy enforcement.

Behest includes PII Shield, powered by Microsoft Presidio. It operates in three modes: disabled, shadow (log but allow), and enforce (actively protect). In enforce mode, you choose from three actions: mask (reversible tokenization), redact (permanent removal), or block (reject the request entirely). PII is detected using named entity recognition and regex patterns before it ever reaches the LLM.

Behest includes Sentinel, an automatic prompt injection defense system. It uses multiple detection patterns to identify common jailbreak techniques, plus custom blocklists per project. Sentinel operates in three modes: disabled, shadow (log detected attacks), and enforce (block malicious prompts). All detection happens before the request reaches the LLM.

Yes. API keys are hashed with Argon2id, JWTs use RS256 signing, and tenant isolation ensures one customer's data is never accessible to another. Behest runs as SaaS by default; Enterprise customers can self-host Behest in their own cloud infrastructure so keys and data are processed in their environment and, with self-hosted models, stay there.

Both. Behest runs as SaaS in our cloud, or — on the Enterprise tier — self-hosts the control center in your own cloud (VPC). With the self-hosted option, your keys, prompts, and completions are processed in your environment. With self-hosted models, your data stays in your infrastructure end-to-end; when you connect an external provider like OpenAI or Anthropic with your own key, only the PII-scrubbed request egresses, to the destination you choose. You own the keys and control egress.

Yes. Behest records every AI call with model, tokens, cost, user, project, and session, alongside security events such as PII redactions, blocked prompt-injection attempts, and budget denials — the evidence your auditors look for. With the Enterprise self-hosted option, you run the observability stack (OpenTelemetry and Grafana) in your own cloud.

Behest does not hold its own SOC 2, HIPAA, or ISO 27001 certification today; formal SOC 2 is on our roadmap. What Behest provides are the technical controls your auditors look for — an optional self-hosted deployment, a full audit trail, per-tenant and per-user access control, and PII scrubbing — so it can run inside the boundary you have already audited and supports your SOC 2, HIPAA, or GDPR program. Whether your program meets a framework is a determination you make with your auditor.

Most LLM providers (OpenAI, Anthropic, Google) block browser requests because they do not support CORS. Behest solves this with per-project CORS configuration. Set your allowed origins in the Behest dashboard, and your frontend JavaScript can call the Behest API directly — no backend proxy needed.

Behest routes across all major LLM providers via LiteLLM: OpenAI, Anthropic, Google Gemini, Vertex AI, AWS Bedrock, Mistral, Cohere, OpenRouter, DeepSeek, Groq, Together AI, and Fireworks AI. Bring your own provider keys (BYOAK v2) for direct billing, or use the Behest-managed default (Gemini 2.5 Flash / Pro on Vertex AI) on the Free tier.

Behest uses the OpenAI-compatible API format. Send a POST request to /v1/chat/completions with an Authorization bearer token, a model name (e.g., gemini-2.5-flash), and a messages array. The response includes choices with message content, finish reason, and token usage statistics. Rate limit headers are included on every response.

Yes — on the Enterprise plan. Behest offers self-hosted deployment in your own cloud infrastructure. (SaaS in Behest's cloud is the default — nothing to operate.) We provide Helm charts for Kubernetes (GKE Autopilot recommended), Docker Compose for local development, and ArgoCD support for GitOps workflows. With self-hosting, your data is processed in your infrastructure; with self-hosted models it stays there, and with an external provider only the PII-scrubbed request egresses.

Behest stores conversation history per-user, per-session in Redis. You can configure the memory window from 0 to 100 message pairs. Memory is automatically injected into the LLM context, trimmed when it exceeds the window size, and can be cleared via API.

Behest enforces three tiers of rate limiting: configurable per-IP rate limiting (safety net), per-project (configurable from 1 to 10,000 requests per minute), and per-user (derived from project limits). Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) are included on every response so your app can handle limits gracefully.

Behest is a SaaS license — not a token markup business. You pay for the platform, not a per-token surcharge on LLM calls. A free trial is available. Contact our sales team for pricing details on the free tier and Enterprise license.

Yes. Sign up at behest.ai/dashboard to start a free trial. You get access to the core developer platform — auth, CORS, PII Shield, Sentinel, memory, rate limiting, and observability — so you can evaluate Behest with your actual use case before committing. Note that the free self-service trial does not include the AI Token FinOps dashboards or enterprise cost-center rollups. To see AI Token FinOps in action, please contact sales for a demo.

Spreadsheets and the monthly provider invoice tell you what you already spent, in aggregate, after the money is gone. Behest is real-time AI Token FinOps: every model call is attributed to a user, project, and session as it happens, and hard budgets block overruns before they reach the invoice. You move from reconciling AI spend to controlling it.

Legacy gateways are primarily for routing and observability. Behest adds deep AI Token FinOps — hard budget enforcement before the invoice, per-session cost attribution, and clean chargebacks — plus AI Governance (PII redaction, prompt-injection defense, model allowlists). If you need enterprise cost control and compliance, Behest provides the guardrails gateways lack.

Cost dashboards and observability tools watch your AI spend after the fact — logging, monitoring, and analyzing usage. Behest governs it in the request path: it attributes every token to a user, project, and session and enforces hard budgets before the spend happens. Observability tells you what you spent; AI Token FinOps stops the overspend.

OpenAI gives you the model and a monthly bill. Behest puts that spend under control: every call is attributed to a user, project, and session, hard budgets stop runaway loops before they hit the invoice, and PII scrubbing and prompt-injection defense run on the request path. Calling OpenAI directly, you learn what you spent after the fact; with Behest you govern it as it happens, and your own provider keys keep billing clean.

An AI gateway sits in front of your LLM and watches traffic — routing, logging, and caching requests. An AI backend operates the full infrastructure: authentication, CORS handling, conversation memory, PII scrubbing, prompt injection defense, rate limiting, token budgets, and observability. A gateway observes; a backend operates. Behest is the enterprise AI Token FinOps platform with governance built in — and it can also operate as your full AI backend if you choose, though that's optional, not a requirement.