How a request is served

We hold accounts with some vendors directly. For the rest we route through OpenRouter, which means your request body reaches that vendor by way of a third party. Saying so matters more than it costs us: where your prompts go is not a detail to leave buried in an architecture diagram.

A model's vendor and the account that pays for it are different questions. You ask for anthropic/claude-sonnet-5 either way; which wire it went down is our problem.

Store your own OpenAI or Anthropic key on the settings page and requests to that vendor go out on it. Your account is invoiced by the provider directly, so we charge nothing for those tokens: no markup, no credit drawn, and the request costs $0.00 in your usage. Billing our catalogue price on top of an invoice you are already receiving would be charging twice for the same tokens.

Your key wins over ours. You went and configured it, which is an instruction about whose account should pay, and quietly routing through ours instead would be overruling that. It applies only to the vendor you stored it for: everything else still goes out on our accounts and is billed normally.

Everything except the money still applies. Rate limits, the request log, attribution, caching, fallbacks and the security checks all work the same, because they are the part you came here for. Your plan's monthly request allowance still counts these requests.

Keys are encrypted at rest and never returned by the API once stored, so the settings page can tell you a key exists but not what it is. If one stops decrypting, requests fall back to our account rather than failing: a rotated secret should not take your traffic down.

The same whether we served you directly or through OpenRouter: we buy wholesale and resell at a flat 20%, and your usage page shows what we paid beside what you paid on every request, so you can check it rather than take our word for it. The one exception is a request on your own provider key, which we do not charge for at all.

Every request records the route it took. Your usage page can group by it, so this is a fact you can verify rather than a claim you have to trust.

x-vatan-model: anthropic/claude-sonnet-5   # which model actually answered

Some models are unavailable from some countries, and a request from one gets a 403 model_unavailable_in_region. Those models are also hidden from the catalogue for such requests, so you never see one you cannot call.

This is a signal rather than a compliance control, and we say so plainly: a VPN defeats it trivially. The controls that actually hold are payment country, declared billing address and screening at signup.