Upload folder using huggingface_hub

app/config.py

@@ -19,6 +19,7 @@ def _decrypt(value: str) -> str:
     if not aes_key:
         raise RuntimeError("Missing AES_KEY environment variable")
     try:
+        aes_key += "=" * (-len(aes_key) % 4)
         key = base64.urlsafe_b64decode(aes_key)
         _, _, nonce_b64, cipher_b64 = value.split(":", 3)
         nonce = base64.urlsafe_b64decode(nonce_b64)

app/data/api_keys.json

@@ -0,0 +1,122 @@
+{
+  "api-6ynmb50kph7orcv": {
+    "ip": "49.204.115.152",
+    "created": 1779295121,
+    "rpm": 4
+  },
+  "api-m1doivz912laas8": {
+    "ip": "185.183.33.13",
+    "created": 1779295175,
+    "rpm": 4
+  },
+  "api-nvi1zzdh6jk6m2n": {
+    "ip": "73.199.13.2",
+    "created": 1779305233,
+    "rpm": 4
+  },
+  "api-mtgq13knyfqa5kg": {
+    "ip": "87.235.72.80",
+    "created": 1779306560,
+    "rpm": 20
+  },
+  "api-5pkv96hvl3lvekx": {
+    "ip": "112.141.166.157",
+    "created": 1779307253,
+    "rpm": 4
+  },
+  "api-q0kqyw9ujjbpc6p": {
+    "ip": "171.79.59.48",
+    "created": 1779308409,
+    "rpm": 4
+  },
+  "api-qdyip624fyemx0x": {
+    "ip": "103.169.53.229",
+    "created": 1779308417,
+    "rpm": 4
+  },
+  "api-axfw072bcp8cpge": {
+    "ip": "88.241.79.14",
+    "created": 1779308743,
+    "rpm": 4
+  },
+  "api-cnns5zaioeoyz2h": {
+    "ip": "171.79.55.48",
+    "created": 1779309378,
+    "rpm": 4
+  },
+  "api-n6xmtr9vto88nqi": {
+    "ip": "138.199.7.229",
+    "created": 1779311977,
+    "rpm": 4
+  },
+  "api-zly9qxgnhh0yb00": {
+    "ip": "138.199.7.226",
+    "created": 1779312216,
+    "rpm": 4
+  },
+  "api-7u2yg8fan97pglk": {
+    "ip": "42.111.145.231",
+    "created": 1779347701,
+    "rpm": 4
+  },
+  "api-flaoa2ckj36mjsr": {
+    "ip": "95.1.126.214",
+    "created": 1779353574,
+    "rpm": 4
+  },
+  "api-0jsp9emdgezny4a": {
+    "ip": "88.229.222.114",
+    "created": 1779357368,
+    "rpm": 4
+  },
+  "api-5i88dgwxtjycjdj": {
+    "ip": "157.49.198.214",
+    "created": 1779359394,
+    "rpm": 4
+  },
+  "api-muozs3xm474rvn1": {
+    "ip": "78.190.249.157",
+    "created": 1779360625,
+    "rpm": 4
+  },
+  "api-0bpt9bap7y67c2c": {
+    "ip": "108.18.234.199",
+    "created": 1779394538,
+    "rpm": 4
+  },
+  "api-wqwolj17a9c6ca3": {
+    "ip": "49.204.116.8",
+    "created": 1779397943,
+    "rpm": 4
+  },
+  "api-wbhawdhpuqyrp2g": {
+    "ip": "47.60.40.235",
+    "created": 1779458372,
+    "rpm": 20
+  },
+  "api-o6aquyfeyw0lw4f": {
+    "ip": "114.8.227.150",
+    "created": 1779471144,
+    "rpm": 4
+  },
+  "api-os34e5ak7z7kpup": {
+    "ip": "95.5.119.10",
+    "created": 1779481321,
+    "rpm": 4
+  },
+  "api-33jvm6e1oocn2zq": {
+    "ip": "176.234.207.27",
+    "created": 1779521914,
+    "rpm": 4
+  },
+  "api-ajerid71amwqc7o": {
+    "ip": "49.204.137.8",
+    "created": 1779561515,
+    "rpm": 4
+  },
+  "api-o3ihnwbp70kud13": {
+    "ip": "88.246.193.149",
+    "created": 1779564512,
+    "rpm": 4
+  }
+}

app/data/chat_logs/.~lock.2026-05-22.jsonl#

@@ -0,0 +1 @@
+,berkay,BerkayKral,23.05.2026 16:05,file:///home/berkay/.config/libreoffice/4;

app/data/chat_logs/2026-05-22.jsonl

@@ -0,0 +1,38 @@
+{"timestamp": "2026-05-22T14:19:21.213884", "ip": "127.0.0.1", "model": "gpt-5", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:19:29.642073", "ip": "127.0.0.1", "model": "gpt-5.1", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:19:39.374349", "ip": "127.0.0.1", "model": "gpt-5.3", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:19:49.222915", "ip": "127.0.0.1", "model": "gpt-5.4-gateway", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:19:56.423839", "ip": "127.0.0.1", "model": "gpt-5.5-gateway", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:20:04.793460", "ip": "127.0.0.1", "model": "o3", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:20:17.794998", "ip": "127.0.0.1", "model": "o3-mini", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello."}
+{"timestamp": "2026-05-22T14:20:29.882273", "ip": "127.0.0.1", "model": "o4-mini", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:23:23.571003", "ip": "127.0.0.1", "model": "gpt-4o", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:23:29.177315", "ip": "127.0.0.1", "model": "gpt-4.1-mini", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:23:39.965982", "ip": "127.0.0.1", "model": "gpt-4.1-nano", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:23:45.915690", "ip": "127.0.0.1", "model": "gpt-5-mini", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:23:51.500554", "ip": "127.0.0.1", "model": "gpt-5-nano", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:23:59.628258", "ip": "127.0.0.1", "model": "gpt-5-online", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:24:04.627485", "ip": "127.0.0.1", "model": "claude-opus-4.7", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:24:14.368115", "ip": "127.0.0.1", "model": "claude-opus-4.6-gateway", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:24:20.627386", "ip": "127.0.0.1", "model": "claude-opus-4.5", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:24:34.625092", "ip": "127.0.0.1", "model": "claude-opus-4.1", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi!"}
+{"timestamp": "2026-05-22T14:24:40.799506", "ip": "127.0.0.1", "model": "claude-sonnet-4", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi!"}
+{"timestamp": "2026-05-22T14:24:48.311807", "ip": "127.0.0.1", "model": "claude-sonnet-4.6-gateway", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi!"}
+{"timestamp": "2026-05-22T14:24:57.561999", "ip": "127.0.0.1", "model": "gemini-2.5-pro", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello."}
+{"timestamp": "2026-05-22T14:25:04.746413", "ip": "127.0.0.1", "model": "gemini-3-pro", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:25:19.243930", "ip": "127.0.0.1", "model": "gemini-3.1-pro-gateway", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:25:24.618241", "ip": "127.0.0.1", "model": "gemini-2.5-flash", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:25:38.635329", "ip": "127.0.0.1", "model": "deepseek-v4-pro", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:25:50.147293", "ip": "127.0.0.1", "model": "deepseek-v4-flash", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:26:00.991754", "ip": "127.0.0.1", "model": "deepseek-r1", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:27:02.499038", "ip": "127.0.0.1", "model": "deepseek-v3", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:27:07.859817", "ip": "127.0.0.1", "model": "grok-4", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello."}
+{"timestamp": "2026-05-22T14:27:15.919042", "ip": "127.0.0.1", "model": "grok-3", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:27:21.789241", "ip": "127.0.0.1", "model": "qwen-3-max", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi."}
+{"timestamp": "2026-05-22T14:27:37.435616", "ip": "127.0.0.1", "model": "qwen-qwq-32b", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello."}
+{"timestamp": "2026-05-22T14:27:43.835269", "ip": "127.0.0.1", "model": "kimi-k2", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T14:27:52.077500", "ip": "127.0.0.1", "model": "llama-3.3-70b-versatile", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hello"}
+{"timestamp": "2026-05-22T14:49:31.725453", "ip": "127.0.0.1", "model": "gpt-5", "key_type": "master", "input": [{"role": "user", "content": "What is the weather in Tokyo? Use the tool."}], "output": ""}
+{"timestamp": "2026-05-22T14:51:53.157473", "ip": "127.0.0.1", "model": "gpt-5", "key_type": "master", "input": [{"role": "user", "content": "What is the weather in Tokyo? Use the tool."}], "output": ""}
+{"timestamp": "2026-05-22T16:46:18.154483", "ip": "127.0.0.1", "model": "gpt-5", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi"}
+{"timestamp": "2026-05-22T16:46:20.413839", "ip": "127.0.0.1", "model": "gpt-5.4", "key_type": "master", "input": [{"role": "user", "content": "Say hi in one word."}], "output": "Hi!"}

app/data/providers.json

@@ -0,0 +1,142 @@
+{
+  "localtest-0b3498": {
+    "name": "LocalTest",
+    "base_url": "http://localhost:1111/v1",
+    "keys": [
+      "api-oldbutgodzenoth"
+    ],
+    "models": [
+      "claude-opus-4.6",
+      "claude-sonnet-4.6",
+      "deepseek-v4-pro",
+      "gemini-3.1-pro",
+      "glm-5.1",
+      "gpt-5.3-codex",
+      "gpt-5.4",
+      "gpt-5.5",
+      "gpt-5.5-cyber",
+      "grok-4.2",
+      "kimi-k2.6",
+      "mimo-2.5-pro",
+      "minimax-m2.7",
+      "qwen-3.6-max",
+      "qwen-3.6-plus",
+      "qwen-3.7-max",
+      "step-3.5-flash",
+      "claude-opus-4.1",
+      "claude-opus-4.5",
+      "claude-opus-4.6-gateway",
+      "claude-opus-4.7",
+      "claude-sonnet-4",
+      "claude-sonnet-4.6-gateway",
+      "deepseek-r1",
+      "deepseek-v3",
+      "deepseek-v4-flash",
+      "gemini-2.5-flash",
+      "gemini-2.5-pro",
+      "gemini-3-pro",
+      "gemini-3.1-pro-gateway",
+      "gpt-4.1-mini",
+      "gpt-4.1-nano",
+      "gpt-4o",
+      "gpt-5",
+      "gpt-5-mini",
+      "gpt-5-nano",
+      "gpt-5-online",
+      "gpt-5.1",
+      "gpt-5.3",
+      "gpt-5.4-gateway",
+      "gpt-5.5-gateway",
+      "grok-3",
+      "grok-4",
+      "kimi-k2",
+      "llama-3.3-70b-versatile",
+      "o3",
+      "o3-mini",
+      "o4-mini",
+      "qwen-3-max",
+      "qwen-qwq-32b",
+      "gpt-image-1",
+      "gpt-image-2"
+    ],
+    "added_at": 1779570172
+  },
+  "mistral-7503f8": {
+    "name": "Mistral",
+    "base_url": "https://api.mistral.ai/v1",
+    "keys": [
+      "hajUBLnpbKBo5pCEhcr7SZYHrnRvnQxZ"
+    ],
+    "models": [
+      "mistral-medium-2505",
+      "mistral-medium-2508",
+      "mistral-medium-latest",
+      "mistral-medium",
+      "mistral-vibe-cli-with-tools",
+      "open-mistral-nemo",
+      "open-mistral-nemo-2407",
+      "mistral-tiny-2407",
+      "mistral-tiny-latest",
+      "codestral-2508",
+      "codestral-latest",
+      "devstral-2512",
+      "devstral-medium-latest",
+      "devstral-latest",
+      "mistral-small-2603",
+      "mistral-small-latest",
+      "mistral-vibe-cli-fast",
+      "magistral-small-latest",
+      "magistral-medium-2509",
+      "magistral-medium-latest",
+      "voxtral-small-2507",
+      "voxtral-small-latest",
+      "labs-leanstral-2603",
+      "mistral-large-2512",
+      "mistral-large-latest",
+      "mistral-large-2512",
+      "mistral-large-latest",
+      "ministral-3b-2512",
+      "ministral-3b-latest",
+      "ministral-8b-2512",
+      "ministral-8b-latest",
+      "ministral-14b-2512",
+      "ministral-14b-latest",
+      "mistral-medium-3-5",
+      "mistral-medium-3.5",
+      "mistral-medium-3",
+      "mistral-medium-2604",
+      "mistral-medium-c21211-r0-75",
+      "mistral-vibe-cli-latest",
+      "mistral-large-2411",
+      "pixtral-large-2411",
+      "pixtral-large-latest",
+      "mistral-large-pixtral-2411",
+      "devstral-small-2507",
+      "devstral-medium-2507",
+      "voxtral-mini-2507",
+      "voxtral-mini-latest",
+      "magistral-small-2509",
+      "mistral-small-2506",
+      "mistral-embed-2312",
+      "mistral-embed",
+      "codestral-embed",
+      "codestral-embed-2505",
+      "mistral-moderation-2603",
+      "mistral-moderation-2411",
+      "mistral-moderation-latest",
+      "mistral-ocr-2512",
+      "mistral-ocr-latest",
+      "mistral-ocr-2505",
+      "voxtral-mini-2602",
+      "voxtral-mini-latest",
+      "voxtral-mini-transcribe-realtime-2602",
+      "voxtral-mini-realtime-2602",
+      "voxtral-mini-realtime-latest",
+      "voxtral-mini-transcribe-2507",
+      "voxtral-mini-2507",
+      "voxtral-mini-tts-2603",
+      "voxtral-mini-tts-latest"
+    ],
+    "added_at": 1779570266
+  }
+}

app/index.py

@@ -46,9 +46,14 @@ MAX_CONTINUATIONS = 0
 
 RPM_LIMIT = 4
 KEYS_FILE = os.path.join(os.path.dirname(__file__), "data", "api_keys.json")
+PROVIDERS_FILE = os.path.join(os.path.dirname(__file__), "data", "providers.json")
 
 _rate_limits: dict = defaultdict(list)
 
+# ── Dynamic Providers (runtime-imported OpenAI-compatible backends) ─────────
+_dynamic_providers: dict = {}  # provider_id -> {name, base_url, keys, models, added_at}
+
+
 # ── Persistent Storage: GitHub Gist + local fallback ─────────────────────────
 
 _github_token = os.environ.get("GITHUB_TOKEN", GITHUB_TOKEN)
@@ -396,6 +401,7 @@ async def lifespan(application: FastAPI):
     # Preload keys from Gist at startup
     _load_keys()
     logger.info("Preloaded %d API keys from Gist", len(_keys_cache))
+    _load_providers()
     await _fetch_upstream_models()
     yield
 
@@ -930,7 +936,7 @@ async def dashboard_usage(request: Request):
     html = html.replace("MODEL_TOTALS", model_totals)
     html = html.replace("IP_ROWS", ip_rows)
 
-    return HTMLResponse(html)
+    return HTMLResponse(html, headers={"Cache-Control": "no-store, no-cache, must-revalidate", "Pragma": "no-cache"})
 
 
 @app.get("/v1/upstream-models")
@@ -956,7 +962,7 @@ async def admin_list_keys(request: Request):
     if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
         raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
     
-    keys = load_keys_from_gist()
+    keys = _load_keys()
     admin_keys = []
     for key, data in keys.items():
         if data.get("admin_created"):
@@ -969,6 +975,68 @@ async def admin_list_keys(request: Request):
             })
     return {"keys": admin_keys}
 
+@app.get("/admin/stats")
+async def admin_stats(request: Request):
+    """Return aggregated stats for dashboard charts. Requires MASTER_KEY auth."""
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+
+    from datetime import datetime, timedelta
+    # Load local chat logs
+    chat_logs = []
+    try:
+        if os.path.isdir(CHAT_LOG_DIR):
+            for fname in sorted(os.listdir(CHAT_LOG_DIR)):
+                if fname.endswith(".jsonl") and not fname.endswith("_upload.jsonl"):
+                    fpath = os.path.join(CHAT_LOG_DIR, fname)
+                    try:
+                        with open(fpath) as f:
+                            for line in f:
+                                line = line.strip()
+                                if line:
+                                    try:
+                                        chat_logs.append(json.loads(line))
+                                    except json.JSONDecodeError:
+                                        pass
+                    except Exception:
+                        pass
+    except Exception as e:
+        logger.warning("Failed to load local chat logs for stats: %s", e)
+
+    # Build daily buckets for last 7 days
+    today = datetime.utcnow().date()
+    daily_counts = [0] * 7
+    model_counts = {}
+    rate_limited = 0
+    for log in chat_logs:
+        ts = log.get("timestamp", "")
+        try:
+            log_date = datetime.fromisoformat(ts.replace("Z", "+00:00")).date() if ts else None
+        except Exception:
+            log_date = None
+        if log_date:
+            days_ago = (today - log_date).days
+            if 0 <= days_ago < 7:
+                daily_counts[6 - days_ago] += 1
+        model = log.get("model", "unknown")
+        model_counts[model] = model_counts.get(model, 0) + 1
+        if log.get("rate_limited"):
+            rate_limited += 1
+
+    # Top 5 models
+    top_models = sorted(model_counts.items(), key=lambda x: x[1], reverse=True)[:5]
+    # Pad to 5 if needed
+    while len(top_models) < 5:
+        top_models.append(("other", 0))
+
+    return {
+        "total_requests": len(chat_logs),
+        "rate_limited": rate_limited,
+        "requests_by_day": daily_counts,
+        "models": [{"name": m[0], "count": m[1]} for m in top_models],
+    }
+
 @app.post("/admin/keys")
 async def admin_create_key(request: Request, body: AdminKeyRequest):
     """Create a new IP-bound API key. Requires MASTER_KEY auth."""
@@ -985,7 +1053,7 @@ async def admin_create_key(request: Request, body: AdminKeyRequest):
         raise HTTPException(status_code=400, detail={"error": {"message": "Invalid IP address format"}})
     
     # Check duplicate
-    keys = load_keys_from_gist()
+    keys = _load_keys()
     for k, data in keys.items():
         if data.get("ip") == body.ip and data.get("admin_created"):
             raise HTTPException(status_code=409, detail={"error": {"message": f"IP {body.ip} already has key {k}"}})
@@ -999,7 +1067,7 @@ async def admin_create_key(request: Request, body: AdminKeyRequest):
         "status": "active",
         "admin_created": True,
     }
-    save_keys_to_gist(keys)
+    _save_keys(keys)
     
     return {
         "key": new_key,
@@ -1008,6 +1076,45 @@ async def admin_create_key(request: Request, body: AdminKeyRequest):
         "created_at": keys[new_key]["created_at"],
     }
 
+@app.get("/admin/models")
+async def admin_models(request: Request):
+    """Return all currently routed models with provider info. Requires MASTER_KEY auth."""
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+
+    # Build dynamic provider lookup: url -> provider name
+    prov_lookup = {}
+    for pid, prov in _dynamic_providers.items():
+        base_url = prov["base_url"].rstrip("/")
+        prov_lookup[f"{base_url}/chat/completions"] = prov["name"]
+        for m in prov.get("models", []):
+            prov_lookup.setdefault("model:" + m, prov["name"])
+
+    models = []
+    for model_id in sorted(UPSTREAMS.keys()):
+        upstreams = UPSTREAMS[model_id]
+        urls = [u["url"] for u in upstreams]
+        provider = "built-in"
+        for u in urls:
+            if u in prov_lookup:
+                provider = prov_lookup[u]
+                break
+            if f"model:{model_id}" in prov_lookup:
+                provider = prov_lookup[f"model:{model_id}"]
+                break
+        models.append({
+            "id": model_id,
+            "upstreams": len(upstreams),
+            "provider": provider,
+        })
+
+    for m_id in ["gpt-image-1", "gpt-image-2"]:
+        if not any(m["id"] == m_id for m in models):
+            models.append({"id": m_id, "upstreams": 1, "provider": "image-backend"})
+
+    return {"models": models, "total": len(models)}
+
 @app.delete("/admin/keys/{key_id}")
 async def admin_revoke_key(request: Request, key_id: str):
     """Revoke an admin-created API key. Requires MASTER_KEY auth."""
@@ -1015,16 +1122,226 @@ async def admin_revoke_key(request: Request, key_id: str):
     if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
         raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
     
-    keys = load_keys_from_gist()
+    keys = _load_keys()
     if key_id not in keys:
         raise HTTPException(status_code=404, detail={"error": {"message": "Key not found"}})
     if not keys[key_id].get("admin_created"):
         raise HTTPException(status_code=403, detail={"error": {"message": "Cannot revoke non-admin keys"}})
     
     del keys[key_id]
-    save_keys_to_gist(keys)
+    _save_keys(keys)
     return {"success": True}
 
+
+# ── Dynamic Provider Import ─────────────────────────────────────────────────
+
+class ProviderImportRequest(BaseModel):
+    name: str
+    base_url: str  # e.g. https://api.example.com/v1
+    keys: list  # list of API keys (strings)
+
+
+def _load_providers():
+    """Load dynamic providers from disk and inject into UPSTREAMS."""
+    global _dynamic_providers
+    try:
+        if os.path.exists(PROVIDERS_FILE):
+            with open(PROVIDERS_FILE, "r") as f:
+                _dynamic_providers = json.load(f) or {}
+            for pid, prov in _dynamic_providers.items():
+                _register_provider_in_upstreams(prov)
+            logger.info("Loaded %d dynamic providers", len(_dynamic_providers))
+    except Exception as e:
+        logger.warning("Failed to load providers: %s", e)
+        _dynamic_providers = {}
+
+
+def _save_providers():
+    """Persist dynamic providers to disk."""
+    try:
+        os.makedirs(os.path.dirname(PROVIDERS_FILE), exist_ok=True)
+        with open(PROVIDERS_FILE, "w") as f:
+            json.dump(_dynamic_providers, f, indent=2)
+    except Exception as e:
+        logger.warning("Failed to save providers: %s", e)
+
+
+def _register_provider_in_upstreams(prov: dict):
+    """Inject a provider's models + keys into the global UPSTREAMS/UPSTREAM_API_KEYS."""
+    base_url = prov["base_url"].rstrip("/")
+    chat_url = f"{base_url}/chat/completions"
+    keys = prov.get("keys", [])
+    models = prov.get("models", [])
+
+    # Register API keys — use first key as primary, others rotate via round-robin
+    for i, key in enumerate(keys):
+        UPSTREAM_API_KEYS.setdefault(chat_url, key)
+
+    # Register models — each model routes to this provider
+    for model_id in models:
+        # Don't override built-in models
+        if model_id in UPSTREAMS:
+            continue
+        UPSTREAMS[model_id] = [{"url": chat_url, "model": model_id}]
+
+
+@app.get("/admin/providers")
+async def admin_list_providers(request: Request):
+    """List all dynamically imported providers."""
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+
+    out = []
+    for pid, prov in _dynamic_providers.items():
+        out.append({
+            "id": pid,
+            "name": prov.get("name", ""),
+            "base_url": prov.get("base_url", ""),
+            "key_count": len(prov.get("keys", [])),
+            "models": prov.get("models", []),
+            "added_at": prov.get("added_at", 0),
+        })
+    return {"providers": out}
+
+
+@app.post("/admin/providers/preview")
+async def admin_preview_provider(request: Request, body: ProviderImportRequest):
+    """Preview models available from an OpenAI-compatible provider (no persistence)."""
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+
+    base_url = body.base_url.rstrip("/")
+    models_url = f"{base_url}/models"
+
+    headers = {"Content-Type": "application/json"}
+    if body.keys:
+        headers["Authorization"] = f"Bearer {body.keys[0]}"
+
+    try:
+        async with httpx.AsyncClient(timeout=15) as client:
+            resp = await client.get(models_url, headers=headers)
+    except Exception as e:
+        raise HTTPException(status_code=502, detail={"error": {"message": f"Failed to reach provider: {e}"}})
+
+    if resp.status_code != 200:
+        raise HTTPException(status_code=502, detail={"error": {"message": f"Provider /models returned {resp.status_code}"}})
+
+    try:
+        data = resp.json()
+    except Exception:
+        raise HTTPException(status_code=502, detail={"error": {"message": "Invalid JSON from provider"}})
+
+    # Support both OpenAI format {"data": [...]} and plain list
+    if isinstance(data, dict) and "data" in data:
+        models = [m.get("id") for m in data["data"] if m.get("id")]
+    elif isinstance(data, list):
+        models = [m.get("id") if isinstance(m, dict) else str(m) for m in data]
+    else:
+        raise HTTPException(status_code=502, detail={"error": {"message": "Unexpected response shape from /models"}})
+
+    models = [m for m in models if m]
+    return {
+        "name": body.name,
+        "base_url": base_url,
+        "model_count": len(models),
+        "models": models,
+    }
+
+
+@app.post("/admin/providers/import")
+async def admin_import_provider(request: Request, body: ProviderImportRequest):
+    """Import an OpenAI-compatible provider: fetch models, register routing, persist."""
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+
+    if not body.keys:
+        raise HTTPException(status_code=400, detail={"error": {"message": "At least one API key required"}})
+
+    base_url = body.base_url.rstrip("/")
+    models_url = f"{base_url}/models"
+
+    headers = {"Content-Type": "application/json", "Authorization": f"Bearer {body.keys[0]}"}
+
+    try:
+        async with httpx.AsyncClient(timeout=15) as client:
+            resp = await client.get(models_url, headers=headers)
+    except Exception as e:
+        raise HTTPException(status_code=502, detail={"error": {"message": f"Failed to reach provider: {e}"}})
+
+    if resp.status_code != 200:
+        raise HTTPException(status_code=502, detail={"error": {"message": f"Provider /models returned {resp.status_code}"}})
+
+    data = resp.json()
+    if isinstance(data, dict) and "data" in data:
+        models = [m.get("id") for m in data["data"] if m.get("id")]
+    elif isinstance(data, list):
+        models = [m.get("id") if isinstance(m, dict) else str(m) for m in data]
+    else:
+        models = []
+
+    models = [m for m in models if m]
+
+    pid = body.name.lower().replace(" ", "-") + "-" + uuid.uuid4().hex[:6]
+    prov = {
+        "name": body.name,
+        "base_url": base_url,
+        "keys": list(body.keys),
+        "models": models,
+        "added_at": int(time.time()),
+    }
+    _dynamic_providers[pid] = prov
+    _register_provider_in_upstreams(prov)
+    _save_providers()
+
+    # Refresh global available models list
+    global _available_models
+    _available_models = list(UPSTREAMS.keys()) + ["gpt-image-1", "gpt-image-2"]
+    logger.info("Imported provider %s with %d models", pid, len(models))
+
+    return {
+        "id": pid,
+        "name": prov["name"],
+        "base_url": base_url,
+        "key_count": len(body.keys),
+        "model_count": len(models),
+        "models": models,
+    }
+
+
+@app.delete("/admin/providers/{provider_id}")
+async def admin_delete_provider(request: Request, provider_id: str):
+    """Remove a dynamic provider and unregister its routes."""
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+
+    if provider_id not in _dynamic_providers:
+        raise HTTPException(status_code=404, detail={"error": {"message": "Provider not found"}})
+
+    prov = _dynamic_providers.pop(provider_id)
+    base_url = prov["base_url"].rstrip("/")
+    chat_url = f"{base_url}/chat/completions"
+
+    # Remove model routes that pointed to this provider
+    for model_id in prov.get("models", []):
+        if model_id in UPSTREAMS:
+            UPSTREAMS[model_id] = [u for u in UPSTREAMS[model_id] if u.get("url") != chat_url]
+            if not UPSTREAMS[model_id]:
+                del UPSTREAMS[model_id]
+
+    # Remove API key mapping if no other provider uses it
+    if chat_url in UPSTREAM_API_KEYS:
+        del UPSTREAM_API_KEYS[chat_url]
+
+    _save_providers()
+    global _available_models
+    _available_models = list(UPSTREAMS.keys()) + ["gpt-image-1", "gpt-image-2"]
+    return {"success": True}
+
+
 # ── Image Generation Endpoint ─────────────────────────────────────────────────
 
 @app.post("/v1/images/generations")
@@ -1119,24 +1436,25 @@ async def get_my_key(request: Request, cf_token: str = None):
             detail={"error": {"message": "VPN/Proxy detected. Please turn off VPN and try again.", "type": "verification_error", "code": "vpn_blocked", "provider": vpn_result["provider"]}}
         )
 
-    # ── Step 2: New user — require Turnstile verification ──
-    if not cf_token:
-        raise HTTPException(status_code=403, detail={"error": {"message": "Verification required", "type": "verification_error", "code": "missing_cf_token"}})
-
-    # Verify Turnstile token with Cloudflare
-    try:
-        verify_resp = await make_client().post(
-            "https://challenges.cloudflare.com/turnstile/v0/siteverify",
-            data={"response": cf_token, "secret": TURNSTILE_SECRET_KEY},
-        )
-        verify_data = verify_resp.json()
-        if not verify_data.get("success"):
-            raise HTTPException(status_code=403, detail={"error": {"message": "Verification failed", "type": "verification_error", "code": "invalid_cf_token"}})
-    except HTTPException:
-        raise
-    except Exception as e:
-        logger.warning("Turnstile verification error: %s", e)
-        raise HTTPException(status_code=500, detail={"error": {"message": "Verification service error", "type": "server_error", "code": "cf_verification_error"}})
+    # ── Step 2: Turnstile verification (optional when TURNSTILE_SECRET_KEY not configured) ──
+    if TURNSTILE_SECRET_KEY:
+        if not cf_token:
+            raise HTTPException(status_code=403, detail={"error": {"message": "Verification required", "type": "verification_error", "code": "missing_cf_token"}})
+        try:
+            verify_resp = await make_client().post(
+                "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+                data={"response": cf_token, "secret": TURNSTILE_SECRET_KEY},
+            )
+            verify_data = verify_resp.json()
+            if not verify_data.get("success"):
+                raise HTTPException(status_code=403, detail={"error": {"message": "Verification failed", "type": "verification_error", "code": "invalid_cf_token"}})
+        except HTTPException:
+            raise
+        except Exception as e:
+            logger.warning("Turnstile verification error: %s", e)
+            raise HTTPException(status_code=500, detail={"error": {"message": "Verification service error", "type": "server_error", "code": "cf_verification_error"}})
+    else:
+        logger.info("Turnstile disabled (no TURNSTILE_SECRET_KEY), allowing key generation for IP %s", client_ip)
 
     # ── Step 3: Auto-generate key for verified user ──
     new_key = generate_api_key()

app/templates/dashboard.html

@@ -94,6 +94,8 @@
             </div>
             <nav class="hidden md:flex items-center gap-6 text-sm">
                 <a href="#stats" class="text-amber-400 font-medium">Dashboard</a>
+                <a href="#providers" class="text-slate-400 hover:text-slate-200 transition">Providers</a>
+                <a href="#models" class="text-slate-400 hover:text-slate-200 transition">Models</a>
                 <a href="#generator" class="text-slate-400 hover:text-slate-200 transition">Keys</a>
                 <a href="#charts" class="text-slate-400 hover:text-slate-200 transition">Analytics</a>
                 <button id="logout-btn" class="text-slate-500 hover:text-red-400 transition text-xs font-mono">logout</button>
@@ -111,7 +113,7 @@
         </div>
 
         <!-- Stats Grid -->
-        <section id="stats" class="grid grid-cols-2 lg:grid-cols-4 gap-4">
+        <section id="stats" class="grid grid-cols-2 lg:grid-cols-5 gap-4">
             <div class="glass glass-hover rounded-xl p-6 transition-all">
                 <div class="flex items-center justify-between mb-3">
                     <svg class="w-5 h-5 text-amber-400" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"/></svg>
@@ -144,6 +146,90 @@
                 <div class="text-3xl font-bold font-mono" id="stat-ratelimited">—</div>
                 <p class="text-xs text-slate-400 mt-1">Rate Limited</p>
             </div>
+            <div class="glass glass-hover rounded-xl p-6 transition-all">
+                <div class="flex items-center justify-between mb-3">
+                    <svg class="w-5 h-5 text-blue-400" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10"/></svg>
+                    <span class="text-xs font-mono text-slate-500">MODELS</span>
+                </div>
+                <div class="text-3xl font-bold font-mono" id="stat-models">—</div>
+                <p class="text-xs text-slate-400 mt-1">Available Models</p>
+            </div>
+        </section>
+
+        <!-- Models Catalog -->
+        <section id="models" class="glass rounded-2xl p-8">
+            <div class="flex items-center justify-between mb-6">
+                <div>
+                    <h3 class="text-xl font-bold">Models Catalog</h3>
+                    <p class="text-sm text-slate-400 mt-1">All models currently routed through the gateway. Updated on startup and provider import.</p>
+                </div>
+                <span class="text-xs font-mono text-blue-500 bg-blue-500/10 px-3 py-1 rounded-full border border-blue-500/20">LIVE</span>
+            </div>
+            <div class="mb-4 flex items-center gap-3">
+                <input id="models-search" type="text" placeholder="Search models..."
+                    class="flex-1 bg-black/30 border border-white/10 rounded-lg px-4 py-2 text-sm font-mono focus:outline-none focus:border-blue-500/50 placeholder:text-slate-600">
+                <span id="models-count" class="text-xs font-mono text-slate-500">0 models</span>
+            </div>
+            <div id="models-grid" class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-4 gap-2 max-h-96 overflow-y-auto pr-2">
+                <p class="text-xs text-slate-600 font-mono col-span-full">Loading models...</p>
+            </div>
+        </section>
+
+        <!-- Provider Import -->
+        <section id="providers" class="glass rounded-2xl p-8">
+            <div class="flex items-center justify-between mb-6">
+                <div>
+                    <h3 class="text-xl font-bold">Import Provider</h3>
+                    <p class="text-sm text-slate-400 mt-1">Connect any OpenAI-compatible API endpoint. Paste base URL + keys, models are fetched automatically.</p>
+                </div>
+                <span class="text-xs font-mono text-emerald-500 bg-emerald-500/10 px-3 py-1 rounded-full border border-emerald-500/20">DYNAMIC</span>
+            </div>
+
+            <form id="provider-form" class="grid md:grid-cols-12 gap-4">
+                <div class="md:col-span-3">
+                    <label class="block text-xs font-mono text-slate-400 mb-2 uppercase tracking-wider">Provider Name *</label>
+                    <input id="prov-name" type="text" placeholder="e.g. MyProxy"
+                        class="w-full bg-black/30 border border-white/10 rounded-lg px-4 py-3 text-sm font-mono focus:outline-none focus:border-amber-500/50">
+                </div>
+                <div class="md:col-span-5">
+                    <label class="block text-xs font-mono text-slate-400 mb-2 uppercase tracking-wider">Base URL *</label>
+                    <input id="prov-url" type="text" placeholder="https://api.example.com/v1"
+                        class="w-full bg-black/30 border border-white/10 rounded-lg px-4 py-3 text-sm font-mono focus:outline-none focus:border-amber-500/50">
+                </div>
+                <div class="md:col-span-4">
+                    <label class="block text-xs font-mono text-slate-400 mb-2 uppercase tracking-wider">API Keys (one per line)</label>
+                    <textarea id="prov-keys" rows="2" placeholder="sk-abc123...&#10;sk-def456..."
+                        class="w-full bg-black/30 border border-white/10 rounded-lg px-4 py-3 text-xs font-mono focus:outline-none focus:border-amber-500/50 resize-none"></textarea>
+                </div>
+                <div class="md:col-span-12 flex gap-3 items-center">
+                    <button type="button" id="prov-preview-btn"
+                        class="bg-slate-700 hover:bg-slate-600 text-slate-100 font-medium px-5 py-2.5 rounded-lg transition text-sm">
+                        Preview Models
+                    </button>
+                    <button type="button" id="prov-import-btn"
+                        class="bg-gradient-to-r from-amber-500 to-amber-600 hover:from-amber-400 hover:to-amber-500 text-black font-semibold px-5 py-2.5 rounded-lg transition text-sm">
+                        Import Provider
+                    </button>
+                    <span id="prov-status" class="text-xs font-mono text-slate-500"></span>
+                </div>
+            </form>
+
+            <!-- Preview panel -->
+            <div id="prov-preview" class="hidden mt-6 p-5 bg-black/30 rounded-xl border border-white/5">
+                <div class="flex items-center justify-between mb-3">
+                    <h4 class="font-semibold text-sm">Available Models</h4>
+                    <span id="prov-preview-count" class="text-xs font-mono text-amber-400">—</span>
+                </div>
+                <div id="prov-preview-list" class="flex flex-wrap gap-2 max-h-48 overflow-y-auto"></div>
+            </div>
+
+            <!-- Providers list -->
+            <div class="mt-8">
+                <h4 class="text-sm font-mono text-slate-400 uppercase tracking-wider mb-3">Active Providers</h4>
+                <div id="providers-list" class="space-y-2">
+                    <p class="text-xs text-slate-600 font-mono">No dynamic providers yet</p>
+                </div>
+            </div>
         </section>
 
         <!-- Key Generator -->
@@ -265,6 +351,8 @@
         if (masterKey) {
             showDashboard();
             loadKeys();
+            loadProviders();
+            loadModels();
         } else {
             showAuth();
         }
@@ -283,6 +371,7 @@
                 authError.classList.add('hidden');
                 showDashboard();
                 loadKeys();
+                loadProviders();
             } else {
                 authError.textContent = 'Invalid master key';
                 authError.classList.remove('hidden');
@@ -323,8 +412,8 @@
             if (!r || !r.ok) return;
             const data = await r.json();
             keysData = data.keys || [];
-            renderStats();
             renderTable();
+            await loadStats();
             renderCharts();
             $('last-sync').textContent = new Date().toLocaleTimeString();
         } catch (e) {
@@ -332,12 +421,23 @@
         }
     }
 
+    let _statsCache = null;
+    async function loadStats() {
+        try {
+            const r = await api('/admin/stats');
+            if (r && r.ok) _statsCache = await r.json();
+        } catch (e) { /* ignore */ }
+        renderStats();
+    }
+
     function renderStats() {
         $('stat-total').textContent = keysData.length;
         const active = keysData.filter(k => k.status === 'active');
         $('stat-active').textContent = new Set(active.map(k => k.ip)).size;
-        $('stat-requests').textContent = '—';
-        $('stat-ratelimited').textContent = '—';
+        if (_statsCache) {
+            $('stat-requests').textContent = (_statsCache.total_requests || 0).toLocaleString();
+            $('stat-ratelimited').textContent = (_statsCache.rate_limited || 0).toLocaleString();
+        }
     }
 
     function maskKey(k) {
@@ -465,13 +565,15 @@
             return d.toLocaleDateString(undefined, { weekday: 'short' });
         });
 
+        const reqData = (_statsCache && _statsCache.requests_by_day) ? _statsCache.requests_by_day : [0,0,0,0,0,0,0];
+
         if (chartRequests) chartRequests.destroy();
         chartRequests = new Chart($('chart-requests'), {
             type: 'line',
             data: {
                 labels: days,
                 datasets: [{
-                    label: 'Requests', data: [0,0,0,0,0,0,0],
+                    label: 'Requests', data: reqData,
                     borderColor: '#f59e0b', backgroundColor: 'rgba(245, 158, 11, 0.1)',
                     fill: true, tension: 0.4, pointRadius: 4, pointBackgroundColor: '#f59e0b',
                 }]
@@ -479,22 +581,206 @@
             options: { responsive: true, plugins: { legend: { display: false } }, scales: { y: { beginAtZero: true, grid: { color: 'rgba(255,255,255,0.05)' } }, x: { grid: { display: false } } } }
         });
 
+        const modelPalette = ['#f59e0b', '#3b82f6', '#10b981', '#8b5cf6', '#64748b'];
+        const modelLabels = (_statsCache && _statsCache.models) ? _statsCache.models.map(m => m.name) : [];
+        const modelData = (_statsCache && _statsCache.models) ? _statsCache.models.map(m => m.count) : [];
+
         if (chartModels) chartModels.destroy();
-        chartModels = new Chart($('chart-models'), {
-            type: 'doughnut',
-            data: {
-                labels: ['gpt-4', 'claude', 'gemini', 'deepseek', 'other'],
-                datasets: [{
-                    data: [30, 25, 20, 15, 10],
-                    backgroundColor: ['#f59e0b', '#3b82f6', '#10b981', '#8b5cf6', '#64748b'],
-                    borderColor: '#0a0a0f', borderWidth: 2,
-                }]
-            },
-            options: { responsive: true, plugins: { legend: { position: 'bottom', labels: { font: { family: "'JetBrains Mono'", size: 11 }, padding: 12 } } } }
-        });
+        if (modelLabels.length > 0) {
+            chartModels = new Chart($('chart-models'), {
+                type: 'doughnut',
+                data: {
+                    labels: modelLabels,
+                    datasets: [{
+                        data: modelData,
+                        backgroundColor: modelPalette.slice(0, modelLabels.length),
+                        borderColor: '#0a0a0f', borderWidth: 2,
+                    }]
+                },
+                options: { responsive: true, plugins: { legend: { position: 'bottom', labels: { font: { family: "'JetBrains Mono'", size: 11 }, padding: 12 } } } }
+            });
+        }
+    }
+
+    // ── Provider Management ─────────────────────────────────────
+    function escapeHtml(s) {
+        return String(s || '').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+    }
+
+    async function loadProviders() {
+        try {
+            const r = await api('/admin/providers');
+            if (!r || !r.ok) return;
+            const data = await r.json();
+            renderProvidersList(data.providers || []);
+        } catch (e) {
+            console.error('Error loading providers:', e);
+        }
+    }
+
+    function renderProvidersList(providers) {
+        const list = $('providers-list');
+        if (!list) return;
+        if (providers.length === 0) {
+            list.innerHTML = '<p class="text-xs text-slate-600 font-mono">No dynamic providers yet</p>';
+            return;
+        }
+        list.innerHTML = providers.map(p => `
+            <div class="bg-black/30 rounded-lg p-4 flex items-center justify-between border border-white/5">
+                <div class="flex-1 min-w-0">
+                    <div class="flex items-center gap-2">
+                        <span class="font-semibold text-amber-400 text-sm">${escapeHtml(p.name)}</span>
+                        <span class="text-xs font-mono text-slate-600">${p.id}</span>
+                    </div>
+                    <div class="text-xs text-slate-400 font-mono mt-1 truncate">${escapeHtml(p.base_url)}</div>
+                    <div class="flex gap-3 mt-2">
+                        <span class="text-xs text-slate-500 font-mono">${p.key_count} keys</span>
+                        <span class="text-xs text-slate-500 font-mono">·</span>
+                        <span class="text-xs text-emerald-400 font-mono">${(p.models || []).length} models</span>
+                    </div>
+                </div>
+                <button onclick="window.__deleteProvider('${p.id}')" class="ml-3 text-red-400/70 hover:text-red-400 text-xs font-mono px-2 py-1">DELETE</button>
+            </div>
+        `).join('');
+    }
+    window.__deleteProvider = async function(id) {
+        if (!confirm('Delete this provider and all its model routes?')) return;
+        try {
+            const r = await api('/admin/providers/' + id, { method: 'DELETE' });
+            if (!r || !r.ok) throw new Error('Delete failed');
+            toast('Provider deleted', 'success');
+            await loadProviders();
+        } catch (e) {
+            toast('Delete failed: ' + e.message, 'error');
+        }
+    };
+
+    async function previewProvider() {
+        const name = $('prov-name').value.trim();
+        const baseUrl = $('prov-url').value.trim();
+        const keysText = $('prov-keys').value.trim();
+        const keys = keysText.split('\n').map(k => k.trim()).filter(k => k);
+        const status = $('prov-status');
+
+        if (!name || !baseUrl) { toast('Name and Base URL required', 'error'); return; }
+
+        const btn = $('prov-preview-btn');
+        btn.disabled = true; btn.textContent = 'Probing...';
+        status.textContent = '';
+        try {
+            const r = await api('/admin/providers/preview', {
+                method: 'POST',
+                body: JSON.stringify({ name, base_url: baseUrl, keys })
+            });
+            if (!r || !r.ok) {
+                const d = await r.json();
+                throw new Error(d?.error?.message || 'Preview failed');
+            }
+            const data = await r.json();
+            const preview = $('prov-preview');
+            preview.classList.remove('hidden');
+            $('prov-preview-count').textContent = `${data.models.length} models`;
+            $('prov-preview-list').innerHTML = data.models.map(m => 
+                `<span class="bg-slate-800 border border-white/5 text-slate-300 text-xs font-mono px-2 py-1 rounded">${escapeHtml(m)}</span>`
+            ).join('');
+            status.textContent = `✓ ${data.models.length} models found`;
+            status.className = 'text-xs font-mono text-emerald-400';
+        } catch (e) {
+            status.textContent = `✗ ${e.message}`;
+            status.className = 'text-xs font-mono text-red-400';
+        } finally {
+            btn.disabled = false; btn.textContent = 'Preview Models';
+        }
+    }
+
+    async function importProvider() {
+        const name = $('prov-name').value.trim();
+        const baseUrl = $('prov-url').value.trim();
+        const keysText = $('prov-keys').value.trim();
+        const keys = keysText.split('\n').map(k => k.trim()).filter(k => k);
+        const status = $('prov-status');
+
+        if (!name || !baseUrl || keys.length === 0) {
+            toast('Name, URL, and at least one key required', 'error'); return;
+        }
+
+        const btn = $('prov-import-btn');
+        btn.disabled = true; btn.textContent = 'Importing...';
+        status.textContent = '';
+        try {
+            const r = await api('/admin/providers/import', {
+                method: 'POST',
+                body: JSON.stringify({ name, base_url: baseUrl, keys })
+            });
+            if (!r || !r.ok) {
+                const d = await r.json();
+                throw new Error(d?.error?.message || 'Import failed');
+            }
+            const data = await r.json();
+            toast(`Imported ${data.model_count} models from ${data.name}`, 'success');
+            $('prov-name').value = '';
+            $('prov-url').value = '';
+            $('prov-keys').value = '';
+            $('prov-preview').classList.add('hidden');
+            status.textContent = `✓ ${data.model_count} models registered`;
+            status.className = 'text-xs font-mono text-emerald-400';
+            await loadProviders();
+        } catch (e) {
+            status.textContent = `✗ ${e.message}`;
+            status.className = 'text-xs font-mono text-red-400';
+            toast('Import failed: ' + e.message, 'error');
+        } finally {
+            btn.disabled = false; btn.textContent = 'Import Provider';
+        }
+    }
+
+    if ($('prov-preview-btn')) $('prov-preview-btn').addEventListener('click', previewProvider);
+    if ($('prov-import-btn')) $('prov-import-btn').addEventListener('click', importProvider);
+
+    // ── Models Catalog ─────────────────────────────────────────
+    let _modelsCache = [];
+    async function loadModels() {
+        try {
+            const r = await api('/admin/models');
+            if (!r || !r.ok) return;
+            const data = await r.json();
+            _modelsCache = data.models || [];
+            if ($('stat-models')) $('stat-models').textContent = data.total || _modelsCache.length;
+            renderModels('');
+            const count = $('models-count');
+            if (count) count.textContent = `${_modelsCache.length} models`;
+        } catch (e) {
+            console.error('Error loading models:', e);
+        }
+    }
+    function renderModels(q) {
+        const grid = $('models-grid');
+        if (!grid) return;
+        q = (q || '').toLowerCase();
+        const filtered = q ? _modelsCache.filter(m => m.id.toLowerCase().includes(q) || (m.provider || '').toLowerCase().includes(q)) : _modelsCache;
+        if ($('models-count')) $('models-count').textContent = `${filtered.length} models`;
+        if (filtered.length === 0) {
+            grid.innerHTML = '<p class="text-xs text-slate-600 font-mono col-span-full">No models match</p>';
+            return;
+        }
+        grid.innerHTML = filtered.map(m => `
+            <div class="bg-black/30 border border-white/5 hover:border-amber-500/30 rounded-lg p-3 transition cursor-pointer" onclick="navigator.clipboard.writeText('${escapeHtml(m.id)}').then(()=>document.dispatchEvent(new CustomEvent('toast',{detail:'Copied: ${escapeHtml(m.id)}'})))">
+                <div class="flex items-start justify-between gap-2">
+                    <span class="font-mono text-xs text-slate-200 break-all">${escapeHtml(m.id)}</span>
+                    ${m.upstreams > 1 ? `<span class="text-[10px] font-mono text-amber-400 bg-amber-500/10 px-1.5 py-0.5 rounded flex-shrink-0">x${m.upstreams}</span>` : ''}
+                </div>
+                <div class="mt-1.5 flex items-center gap-1.5">
+                    <span class="w-1.5 h-1.5 rounded-full ${m.provider === 'built-in' ? 'bg-blue-400' : m.provider === 'image-backend' ? 'bg-purple-400' : 'bg-emerald-400'}"></span>
+                    <span class="text-[10px] font-mono text-slate-500 truncate">${escapeHtml(m.provider)}</span>
+                </div>
+            </div>
+        `).join('');
     }
+    document.addEventListener('toast', (e) => toast(e.detail));
+    if ($('models-search')) $('models-search').addEventListener('input', (e) => renderModels(e.target.value));
 
     initAuth();
+    loadModels();
 })();
 </script>
 </body>