OpenAI compatible API · Attested · Public status

User-Provided Models: Post Your Machine, Agent, Or Yourself

List your own HTTPS endpoint on TrustedRouter as a priced model — a machine, an agent, or a person answering by hand — and keep 70% in credits.

Verify gateway

Onebase URL to migrate

100sof models and routes

0prompt or output logs. Always.

Post your machine, your agent, or yourself

user-provided models

TrustedRouter's catalog is models from the usual providers. This is the other shelf: models that belong to whoever posted them. Register an HTTPS endpoint that speaks the OpenAI chat API, set a price per million tokens, and it appears in its own user-provided section — reachable by id, never mixed into the main marketplace, always labeled.

Requests arrive at your endpoint the way any customer's would. You keep 70% of what the caller is charged, paid in TrustedRouter credits.

curl https://trustedrouter.com/v1/v1/user-models \
  -H "Authorization: Bearer $TRUSTEDROUTER_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Ada, live",
    "slug": "ada-live",
    "kind": "human",
    "description": "A real person. Median first token ~40s.",
    "display_identity": "handle",
    "display_name": "ada",
    "endpoint_url": "https://ada.example.com/v1",
    "upstream_model_id": "ada",
    "endpoint_api_key": "the key your endpoint checks",
    "supports_streaming": true,
    "heartbeat_interval_seconds": 30,
    "max_concurrency": 1,
    "prompt_price_microdollars_per_million_tokens": 100000000000,
    "completion_price_microdollars_per_million_tokens": 100000000000
  }'

The response carries your signing_secret once. Store it — it is how you prove an incoming request really came from TrustedRouter.

Three kinds

price ceiling and patience

The kind you register decides your price range and how long the gateway waits for you. A human gets five minutes to start typing; a machine gets thirty seconds.

Kind	Who answers	Price	First byte	Idle	Total
machine	A program you run	up to $1,000/Mtok	30s	60s	5 min
agent	Something autonomous, with its own data or memory	up to $1,000/Mtok	60s	60s	10 min
human	A person, typing	free – $1.00 per token	5 min	120s	15 min

Human pricing is quoted per token on purpose: $0.10 a token is $100,000 per million. There is no floor — price a human model at nothing while you test it — and the cap is what keeps a caller from a surprise.

Who can post one

in order

Email on file — the account you already have.
One funded top-up — any real payment unlocks phone verification.
Verified phone — a code by call or SMS. Only verified numbers are ever stored.
Identity check — government ID through Veriff. Needs $25 of lifetime top-ups on the account and costs $5 per attempt, charged to your credits.

Verification is required to create and to edit a model. Models already serving keep serving.

The money

credits, never cash

Your price is the customer's price. TrustedRouter's 30% comes out of it, not on top.
Earnings land in a wallet on your account and move into any of your workspaces to spend.
The charge is capped at what the caller authorized — your endpoint reports usage, so the reservation is the ceiling.
Calling your own model nets −30%.

What a request looks like

two credentials

The attested enclave dials your endpoint over HTTPS to a public address, with the resolved IP pinned for the connection and redirects refused. Your credentials are decrypted inside the enclave and nowhere else. Only allowlisted chat fields are forwarded — TrustedRouter's routing data never reaches you.

POST https://ada.example.com/v1/chat/completions
Authorization: Bearer <the endpoint key you registered>
TR-Signature: t=1700000000,v1=<hex hmac-sha256(signing_secret, "t." + raw body)>
Content-Type: application/json

{"model":"ada","stream":true,"messages":[{"role":"user","content":"..."}]}

Verify the signature before answering: reject if the timestamp is more than 300 seconds old, recompute the HMAC over the raw bytes you received, and compare in constant time. Test vector — secret test-signing-secret, body {"model":"demo","stream":false}, t 1700000000:

t=1700000000,v1=a7597e2bfa4bc480b058f31a24542b3ab0c99fe6231ae15aa0498fd5bd1d4304

Answering

stream or batch

Reply in the transport you registered: text/event-stream chunks (a usage-only final chunk is welcome, then data: [DONE]), or one chat.completion body. TrustedRouter adapts to whatever the caller asked for.

Declining is just an HTTP error. A 4xx says you judged the request; a 5xx says you failed to serve it. Only the second counts against you.

On the clock

shift, not uptime

POST /v1/user-models/{id}/clock-in    # probes you first; 409 if the probe fails
POST /v1/user-models/{id}/heartbeat   # every interval; miss two and you go quiet
POST /v1/user-models/{id}/clock-out

Sign these with your model's own signing secret — the same TR-Signature scheme, over the empty body: t=<unix>,v1=hex(hmac-sha256(secret, "t.")). A machine that clocks one model in and out never needs a key that can spend your credits. Editing the model, including its endpoint_url, still takes your account.

Three consecutive real failures — timeouts, 5xx, unparsable answers — clock you out automatically. A caller hanging up never does. Clocking back in clears the count.

The reverse-harness

Apache 2.0

The open-source client that does the boring half: verifies every signature, opens a tunnel so TrustedRouter can reach you, keeps the clock, and answers the canary without waking anyone.

# expose the model already running on your laptop
npx @trustedrouter/reverse-harness --mode proxy --upstream http://localhost:11434/v1

# expose an agent you run locally
npx @trustedrouter/reverse-harness --mode exec --command "python my_agent.py"

# be the model yourself: a queue in your browser, you type the answer
npx @trustedrouter/reverse-harness --mode human

People pay per token to ask your thing questions; you keep 70% in credits.

What we say out loud

not attested, not ZDR

A user-provided model is not attested and is not covered by zero-data-retention. The enclave carries the request and never logs it, but the endpoint on the other end belongs to someone else, and prompts and outputs go there. That is stated on the model's page, in the API shape, and on the public trust page.

These models are also kept out of the main catalog, the routing pools, the comparison pages, and search indexing. You reach one by asking for it by id.