feat: OpenRouter-style provider prefix routing

- Add _get_upstream_for_model() for 'provider/model' format parsing
- Update send_upstream_request() to use new routing with api_key injection
- Provider-specific API keys now correctly passed to upstream
- Syntax validated

app/config.py

@@ -7,6 +7,18 @@ BLOCKED_IPS = {
     "95.5.119.10",
 }
 
+# Cloudflare Turnstile for admin login protection
+TURNSTILE_SITE_KEY = _decrypt("enc:v1:Q1ElsRjDMKIbb-7l:Q2ewoEx10wQFL-BXxTp8Xapb815hL5Iy1_H0Yz9zhQX6DTX2dTgiAA==")
+TURNSTILE_SECRET_KEY = _decrypt("enc:v1:5AVf8i4aUlDhzWIW:_yLBFEmdzSl3FRbaNI1t0FiKA7gXWNPlsBYLCBwMh6yvKCv3wGW_Uf6ArVs9wpzUqfvt")
+
+# Hardcoded balance endpoint map for well-known providers
+BALANCE_ENDPOINTS = {
+    "deepseek": "https://api.deepseek.com/user/balance",
+    "openrouter": "https://openrouter.ai/api/v1/credits",
+    "openai": None,       # usage-based, no public balance
+    "anthropic": None,    # invoice-based
+}
+
 # ── AES decryption ────────────────────────────────────────────────────────────
 # Sensitive values are stored as encrypted blobs in the repo.
 # Set HF Secret: AES_KEY=<base64 32-byte key>

app/index.py

@@ -24,6 +24,7 @@ from config import (
     AI_GATEWAY_URL, UPSTREAM_14448_URL,
     BLOCKED_IPS,
     CHATGPT_IMAGE_API_URL,
+    TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY, BALANCE_ENDPOINTS,
 )
 from pydantic import BaseModel
 import ipaddress
@@ -478,6 +479,43 @@ def normalize_model(model: str) -> str:
     return aliases.get(model, model)
 
 
+def parse_provider_prefix(model: str):
+    """Parse 'provider_name/model_id' format. Returns (provider_name, model_id) or (None, model) if no prefix."""
+    if "/" in model:
+        parts = model.split("/", 1)
+        return parts[0], parts[1]
+    return None, model
+
+
+def _get_upstream_for_model(model: str):
+    """Find upstream URL and API key for a model, handling provider prefix routing."""
+    provider_name, model_id = parse_provider_prefix(model)
+    
+    if provider_name:
+        # Provider prefix routing: find provider by name, route to its base_url
+        for pid, prov in _dynamic_providers.items():
+            if prov.get("name") == provider_name:
+                base_url = prov["base_url"].rstrip("/")
+                chat_url = f"{base_url}/chat/completions"
+                keys = prov.get("keys", [])
+                api_key = keys[0] if keys else ""
+                return chat_url, model_id, api_key
+        # Provider not found, fall through to default routing
+    
+    # Default routing: use UPSTREAMS dict
+    upstreams = UPSTREAMS.get(model_id, [])
+    if not upstreams:
+        upstreams = UPSTREAMS.get(model, [])
+    if not upstreams:
+        # Fallback to default upstream
+        return DEFAULT_UPSTREAM_URL, model, ""
+    
+    upstream = upstreams[0]
+    url = upstream.get("url", DEFAULT_UPSTREAM_URL)
+    api_key = UPSTREAM_API_KEYS.get(url, "")
+    return url, model_id, api_key
+
+
 def parse_upstream_delta(clean: str) -> dict:
     if not clean or clean == "[DONE]" or clean.startswith(":"):
         return {}
@@ -723,7 +761,7 @@ class _BufferedResponse:
             return
 
 
-async def _send_via_curl(url: str, payload: dict):
+async def _send_via_curl(url: str, payload: dict, api_key: str = ""):
     headers = build_upstream_headers(url)
     curl_args = [
         "curl", "-sS", "-X", "POST", url,
@@ -732,7 +770,8 @@ async def _send_via_curl(url: str, payload: dict):
         "--data", json.dumps(payload),
         "-w", "\n__APIARIUM_HTTP_STATUS__:%{http_code}",
     ]
-    auth = headers.get("Authorization")
+    # Use provider-specific api_key if provided, otherwise fall back to URL-based headers
+    auth = f"Bearer {api_key}" if api_key else headers.get("Authorization")
     if auth:
         curl_args[7:7] = ["-H", f"Authorization: {auth}"]
 
@@ -767,9 +806,7 @@ def get_upstream(model: str) -> dict:
 
 async def send_upstream_request(body: dict, model: str):
     """Forward entire request body to upstream, overriding model name."""
-    upstream = get_upstream(model)
-    url = upstream["url"]
-    upstream_model = upstream["model"]
+    url, upstream_model, api_key = _get_upstream_for_model(model)
     logger.info("Routing model=%s → %s (upstream model: %s)", model, url, upstream_model)
 
     payload = {**body, "model": upstream_model}
@@ -797,10 +834,10 @@ async def send_upstream_request(body: dict, model: str):
             "message": message_text or "user: Hello",
             "model": upstream_model,
         }
-        return await _send_via_curl(url, gateway_payload)
+        return await _send_via_curl(url, gateway_payload, api_key)
 
     curl_payload = {**payload, "stream": False}
-    return await _send_via_curl(url, curl_payload)
+    return await _send_via_curl(url, curl_payload, api_key)
 
 
 # ── Landing Page ────────────────────────────────────────────────────────────
@@ -824,10 +861,16 @@ async def health():
 
 @app.get("/v1/models")
 async def list_models():
-    return {
-        "object": "list",
-        "data": [{"id": m, "object": "model", "owned_by": "apiarium"} for m in _available_models],
-    }
+    """List all available models. Dynamic provider models are prefixed (e.g. deepseek/deepseek-chat)."""
+    data = [{"id": m, "object": "model", "owned_by": "apiarium"} for m in _available_models]
+    # Append prefixed models from dynamic providers
+    for pid, prov in _dynamic_providers.items():
+        prov_name = prov.get("name", pid)
+        for m in prov.get("models", []):
+            prefixed = f"{prov_name}/{m}"
+            if prefixed not in _available_models:
+                data.append({"id": prefixed, "object": "model", "owned_by": prov_name})
+    return {"object": "list", "data": data}
 
 
 @app.get("/v1/dashboard")
@@ -1081,7 +1124,40 @@ async def admin_models(request: Request):
     if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
         raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
 
-    # Build dynamic provider lookup: url -> provider name
+    models = []
+    
+    # Dynamic provider models (prefixed: provider_name/model_id)
+    for pid, prov in _dynamic_providers.items():
+        prov_name = prov.get("name", pid)
+        for m in prov.get("models", []):
+            models.append({
+                "name": f"{prov_name}/{m}",
+                "provider": prov_name,
+                "type": "dynamic",
+            })
+    
+    # Built-in models (non-prefixed, from UPSTREAMS but not from dynamic providers)
+    dynamic_models = set()
+    for prov in _dynamic_providers.values():
+        dynamic_models.update(prov.get("models", []))
+    
+    for model_id in sorted(UPSTREAMS.keys()):
+        if model_id in dynamic_models:
+            continue  # Already listed as prefixed
+        upstreams = UPSTREAMS[model_id]
+        urls = [u["url"] for u in upstreams]
+        models.append({
+            "name": model_id,
+            "provider": "built-in",
+            "type": "built-in",
+        })
+
+    return {"models": models}
+
+
+# Legacy endpoint for backward compatibility (old /admin/models signature)
+def _legacy_admin_models_logic():
+    """Old logic kept for reference - no longer used."""
     prov_lookup = {}
     for pid, prov in _dynamic_providers.items():
         base_url = prov["base_url"].rstrip("/")
@@ -1333,6 +1409,614 @@ async def admin_delete_provider(request: Request, provider_id: str):
     return {"success": True}
 
 
+# ── Balance Checker ───────────────────────────────────────────────────────────
+
+def _normalize_balance(data: dict, provider_name: str) -> dict:
+    """Normalize different balance API response formats into a common shape."""
+    result = {"provider": provider_name, "currency": "USD", "balance": None, "used": None, "total": None, "raw": data}
+    
+    # DeepSeek format: {balance_infos: [{currency, total_balance, granted_balance, ...}]}
+    if "balance_infos" in data and isinstance(data["balance_infos"], list) and data["balance_infos"]:
+        info = data["balance_infos"][0]
+        result["currency"] = info.get("currency", "USD")
+        result["total"] = float(info.get("total_balance", 0)) + float(info.get("granted_balance", 0))
+        result["used"] = float(info.get("used_balance", 0)) if "used_balance" in info else None
+        if result["total"] is not None and result["used"] is not None:
+            result["balance"] = result["total"] - result["used"]
+        else:
+            result["balance"] = result["total"]
+        return result
+    
+    # OpenRouter format: {data: {total_credits, total_usage}}
+    if "data" in data and isinstance(data["data"], dict):
+        inner = data["data"]
+        result["total"] = float(inner.get("total_credits", 0))
+        result["used"] = float(inner.get("total_usage", 0))
+        if result["total"] is not None and result["used"] is not None:
+            result["balance"] = result["total"] - result["used"]
+        return result
+    
+    # Generic: try common keys
+    for k in ("balance", "available", "credit", "remaining"):
+        if k in data and data[k] is not None:
+            result["balance"] = float(data[k])
+            break
+    for k in ("total", "total_credits", "limit"):
+        if k in data and data[k] is not None:
+            result["total"] = float(data[k])
+            break
+    for k in ("used", "usage", "spent"):
+        if k in data and data[k] is not None:
+            result["used"] = float(data[k])
+            break
+    
+    return result
+
+
+async def _check_balance_for_provider(provider_id: str) -> dict:
+    """Check balance for a single dynamic provider."""
+    prov = _dynamic_providers.get(provider_id)
+    if not prov:
+        return {"provider_id": provider_id, "error": "Provider not found", "available": False}
+    
+    prov_name = (prov.get("name") or "").lower()
+    keys = prov.get("keys", [])
+    if not keys:
+        return {"provider_id": provider_id, "provider": prov_name, "error": "No API keys configured", "available": False}
+    
+    # Find balance endpoint: provider override > hardcoded map > None
+    balance_url = prov.get("balance_endpoint_url") or BALANCE_ENDPOINTS.get(prov_name)
+    if not balance_url:
+        return {"provider_id": provider_id, "provider": prov_name, "error": "Balance endpoint not configured for this provider", "available": False}
+    
+    try:
+        async with make_client() as client:
+            resp = await client.get(
+                balance_url,
+                headers={"Authorization": f"Bearer {keys[0]}"},
+                timeout=10.0,
+            )
+            if resp.status_code != 200:
+                return {
+                    "provider_id": provider_id,
+                    "provider": prov_name,
+                    "error": f"HTTP {resp.status_code}",
+                    "available": False,
+                }
+            data = resp.json()
+            normalized = _normalize_balance(data, prov_name)
+            normalized["provider_id"] = provider_id
+            normalized["available"] = True
+            normalized["checked_at"] = int(time.time())
+            return normalized
+    except Exception as e:
+        return {"provider_id": provider_id, "provider": prov_name, "error": str(e), "available": False}
+
+
+@app.get("/admin/balance/check/{provider_id}")
+async def admin_balance_check(request: Request, provider_id: str):
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+    result = await _check_balance_for_provider(provider_id)
+    return result
+
+
+@app.get("/admin/balance/check-all")
+async def admin_balance_check_all(request: Request):
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+    results = []
+    for pid in list(_dynamic_providers.keys()):
+        r = await _check_balance_for_provider(pid)
+        results.append(r)
+    return {"results": results, "checked_at": int(time.time())}
+
+
+# ── Provider Key Append/Remove ───────────────────────────────────────────────
+
+class AppendKeysRequest(BaseModel):
+    keys: list = []
+
+
+@app.post("/admin/providers/{provider_id}/keys")
+async def admin_append_provider_keys(request: Request, provider_id: str, body: AppendKeysRequest):
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+    
+    if provider_id not in _dynamic_providers:
+        raise HTTPException(status_code=404, detail={"error": {"message": "Provider not found"}})
+    
+    prov = _dynamic_providers[provider_id]
+    existing = prov.get("keys", [])
+    new_keys = [k for k in body.keys if k and k not in existing]
+    if not new_keys:
+        return {"success": True, "added": 0, "total": len(existing)}
+    
+    prov["keys"] = existing + new_keys
+    
+    # Re-register in UPSTREAM_API_KEYS (first key as primary)
+    base_url = prov["base_url"].rstrip("/")
+    chat_url = f"{base_url}/chat/completions"
+    UPSTREAM_API_KEYS[chat_url] = prov["keys"][0]
+    
+    _save_providers()
+    return {"success": True, "added": len(new_keys), "total": len(prov["keys"])}
+
+
+@app.delete("/admin/providers/{provider_id}/keys/{idx}")
+async def admin_remove_provider_key(request: Request, provider_id: str, idx: int):
+    auth = request.headers.get("authorization", "")
+    if not auth.startswith("Bearer ") or auth.replace("Bearer ", "") != MASTER_KEY:
+        raise HTTPException(status_code=401, detail={"error": {"message": "Invalid master key"}})
+    
+    if provider_id not in _dynamic_providers:
+        raise HTTPException(status_code=404, detail={"error": {"message": "Provider not found"}})
+    
+    prov = _dynamic_providers[provider_id]
+    keys = prov.get("keys", [])
+    if idx < 0 or idx >= len(keys):
+        raise HTTPException(status_code=400, detail={"error": {"message": "Invalid key index"}})
+    
+    keys.pop(idx)
+    prov["keys"] = keys
+    
+    base_url = prov["base_url"].rstrip("/")
+    chat_url = f"{base_url}/chat/completions"
+    if keys:
+        UPSTREAM_API_KEYS[chat_url] = keys[0]
+    elif chat_url in UPSTREAM_API_KEYS:
+        del UPSTREAM_API_KEYS[chat_url]
+    
+    _save_providers()
+    return {"success": True, "remaining": len(keys)}
+
+
+# ── Turnstile Verification ───────────────────────────────────────────────────
+
+class TurnstileVerifyRequest(BaseModel):
+    token: str
+
+
+@app.post("/admin/verify-turnstile")
+async def admin_verify_turnstile(body: TurnstileVerifyRequest):
+    if not TURNSTILE_SECRET_KEY:
+        return {"success": True, "note": "Turnstile not configured, bypassed"}
+    try:
+        async with make_client() as client:
+            resp = await client.post(
+                "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+                data={"response": body.token, "secret": TURNSTILE_SECRET_KEY},
+                timeout=10.0,
+            )
+            result = resp.json()
+            return {"success": bool(result.get("success")), "raw": result}
+    except Exception as e:
+        return {"success": False, "error": str(e)}
+
+
+# ── Multi-Page Admin HTML Routes ─────────────────────────────────────────────
+
+_ADMIN_NAV = [
+    ("/admin/keys", "API Keys", "🔑"),
+    ("/admin/providers", "Providers", "🔌"),
+    ("/admin/balance", "Balance", "💰"),
+    ("/admin/models", "Models", "🤖"),
+    ("/admin/settings", "Settings", "⚙️"),
+]
+
+
+def _admin_layout(title: str, active: str, body_html: str, turnstile_site_key: str = "") -> str:
+    """Render shared admin layout with sidebar navigation."""
+    nav_items = ""
+    for href, label, icon in _ADMIN_NAV:
+        active_cls = "bg-amber-500/10 text-amber-400 border-amber-500/30" if href == active else "text-slate-400 border-transparent hover:text-slate-200 hover:border-slate-700"
+        nav_items += f'<a href="{href}" class="flex items-center gap-3 px-4 py-2.5 rounded-lg border text-sm font-medium transition {active_cls}"><span class="text-base">{icon}</span>{label}</a>\n'
+    
+    return f"""<!DOCTYPE html>
+<html lang="en" class="antialiased">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>APIarium | {title}</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+    <script>
+        tailwind.config = {{
+            theme: {{
+                extend: {{
+                    fontFamily: {{
+                        sans: ['Inter', 'sans-serif'],
+                        mono: ['JetBrains Mono', 'monospace'],
+                    }},
+                }}
+            }}
+        }}
+        const MASTER_KEY = localStorage.getItem('apiarium_master_key') || '';
+        const TURNSTILE_SITE_KEY = '{turnstile_site_key}';
+        function authHeaders() {{ return {{ 'Authorization': 'Bearer ' + MASTER_KEY, 'Content-Type': 'application/json' }}; }}
+        function checkAuth() {{
+            if (!MASTER_KEY) {{ window.location.href = '/admin/login'; return false; }}
+            return true;
+        }}
+    </script>
+</head>
+<body class="bg-slate-950 text-slate-100 min-h-screen">
+    <div class="flex min-h-screen">
+        <aside class="w-64 bg-slate-900/50 border-r border-white/5 p-6 flex flex-col gap-2">
+            <div class="mb-8">
+                <h1 class="text-xl font-bold flex items-center gap-2">🐝 APIarium</h1>
+                <p class="text-xs text-slate-500 mt-1">Admin Console</p>
+            </div>
+            <nav class="flex flex-col gap-1">
+                {nav_items}
+            </nav>
+            <div class="mt-auto pt-6 border-t border-white/5">
+                <a href="/" class="text-sm text-slate-500 hover:text-slate-300">← Back to site</a>
+                <button onclick="localStorage.removeItem('apiarium_master_key'); window.location.href='/admin/login'" class="block mt-2 text-sm text-red-400/70 hover:text-red-400">Logout</button>
+            </div>
+        </aside>
+        <main class="flex-1 p-8 overflow-auto">
+            <h2 class="text-2xl font-bold mb-6">{title}</h2>
+            {body_html}
+        </main>
+    </div>
+</body>
+</html>"""
+
+
+@app.get("/admin")
+async def admin_root():
+    from fastapi.responses import RedirectResponse
+    return RedirectResponse(url="/admin/keys")
+
+
+@app.get("/admin/login", response_class=HTMLResponse)
+async def admin_login_page():
+    html = """<!DOCTYPE html>
+<html lang="en" class="antialiased">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>APIarium | Admin Login</title>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+</head>
+<body class="bg-slate-950 text-slate-100 min-h-screen flex items-center justify-center p-4">
+    <div class="w-full max-w-md">
+        <div class="text-center mb-8">
+            <h1 class="text-3xl font-bold">🐝 APIarium</h1>
+            <p class="text-slate-400 mt-2">Admin Login</p>
+        </div>
+        <div class="bg-slate-900/50 border border-white/5 rounded-xl p-8">
+            <label class="block text-xs font-mono text-slate-400 uppercase tracking-wider mb-2">Master Key</label>
+            <input type="password" id="master-key" placeholder="Enter master key" class="w-full bg-black/30 border border-white/10 rounded-lg px-4 py-3 text-sm font-mono focus:outline-none focus:border-amber-500/50 mb-4">
+            <div id="turnstile-widget" class="flex justify-center mb-4"></div>
+            <div id="login-error" class="text-red-400 text-sm mb-4 hidden"></div>
+            <button id="login-btn" class="w-full bg-gradient-to-r from-amber-500 to-amber-600 hover:from-amber-400 hover:to-amber-500 text-black font-semibold px-5 py-3 rounded-lg transition text-sm">
+                Sign in
+            </button>
+        </div>
+    </div>
+    <script>
+        let turnstileToken = null;
+        const TURNSTILE_SITE_KEY = '__TURNSTILE_SITE_KEY__';
+        
+        if (TURNSTILE_SITE_KEY) {
+            turnstile.render('#turnstile-widget', {
+                sitekey: TURNSTILE_SITE_KEY,
+                callback: (token) => { turnstileToken = token; }
+            });
+        }
+        
+        document.getElementById('login-btn').addEventListener('click', async () => {
+            const errEl = document.getElementById('login-error');
+            errEl.classList.add('hidden');
+            const key = document.getElementById('master-key').value.trim();
+            if (!key) {
+                errEl.textContent = 'Master key required';
+                errEl.classList.remove('hidden');
+                return;
+            }
+            if (TURNSTILE_SITE_KEY && !turnstileToken) {
+                errEl.textContent = 'Please complete the Turnstile challenge';
+                errEl.classList.remove('hidden');
+                return;
+            }
+            
+            // Verify turnstile if configured
+            if (TURNSTILE_SITE_KEY) {
+                try {
+                    const v = await fetch('/admin/verify-turnstile', {
+                        method: 'POST',
+                        headers: {'Content-Type': 'application/json'},
+                        body: JSON.stringify({token: turnstileToken})
+                    }).then(r => r.json());
+                    if (!v.success) {
+                        errEl.textContent = 'Turnstile verification failed';
+                        errEl.classList.remove('hidden');
+                        return;
+                    }
+                } catch (e) {
+                    errEl.textContent = 'Turnstile verification error: ' + e.message;
+                    errEl.classList.remove('hidden');
+                    return;
+                }
+            }
+            
+            // Test master key against /admin/keys
+            try {
+                const r = await fetch('/admin/keys', {headers: {'Authorization': 'Bearer ' + key}});
+                if (r.status === 401) {
+                    errEl.textContent = 'Invalid master key';
+                    errEl.classList.remove('hidden');
+                    return;
+                }
+                if (!r.ok) throw new Error('HTTP ' + r.status);
+            } catch (e) {
+                errEl.textContent = 'Connection error: ' + e.message;
+                errEl.classList.remove('hidden');
+                return;
+            }
+            
+            localStorage.setItem('apiarium_master_key', key);
+            window.location.href = '/admin/keys';
+        });
+    </script>
+</body>
+</html>"""
+    html = html.replace("__TURNSTILE_SITE_KEY__", TURNSTILE_SITE_KEY or "")
+    return HTMLResponse(content=html)
+
+
+@app.get("/admin/keys", response_class=HTMLResponse)
+async def admin_keys_page():
+    body = """
+    <div id="keys-list" class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+        <div class="text-slate-500 text-sm">Loading...</div>
+    </div>
+    <script>
+    if (!checkAuth()) throw new Error('no auth');
+    (async () => {
+        const r = await fetch('/admin/keys', {headers: authHeaders()}).then(r => r.json());
+        const el = document.getElementById('keys-list');
+        if (!r.keys || r.keys.length === 0) {
+            el.innerHTML = '<div class="text-slate-500 text-sm">No admin-created keys yet.</div>';
+            return;
+        }
+        let html = '<table class="w-full text-sm"><thead><tr class="text-left text-slate-400 text-xs uppercase"><th class="py-2">Key</th><th class="py-2">IP</th><th class="py-2">Label</th><th class="py-2">Created</th></tr></thead><tbody>';
+        r.keys.forEach(k => {
+            html += `<tr class="border-t border-white/5"><td class="py-2 font-mono text-xs">${k.key.slice(0,16)}...</td><td class="py-2">${k.ip||''}</td><td class="py-2">${k.label||''}</td><td class="py-2 text-slate-500">${k.created_at||''}</td></tr>`;
+        });
+        html += '</tbody></table>';
+        el.innerHTML = html;
+    })();
+    </script>
+    """
+    return HTMLResponse(content=_admin_layout("API Keys", "/admin/keys", body, TURNSTILE_SITE_KEY))
+
+
+@app.get("/admin/providers", response_class=HTMLResponse)
+async def admin_providers_page():
+    body = """
+    <div class="grid md:grid-cols-2 gap-6">
+        <div class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+            <h3 class="text-lg font-semibold mb-4">Add New Provider</h3>
+            <form id="add-provider-form" class="flex flex-col gap-3">
+                <input type="text" name="name" placeholder="Provider name (e.g. deepseek)" required class="bg-black/30 border border-white/10 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-amber-500/50">
+                <input type="text" name="base_url" placeholder="Base URL (e.g. https://api.deepseek.com/v1)" required class="bg-black/30 border border-white/10 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-amber-500/50">
+                <input type="text" name="balance_endpoint_url" placeholder="Balance endpoint URL (optional override)" class="bg-black/30 border border-white/10 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-amber-500/50">
+                <textarea name="models" placeholder="Models (one per line)" rows="2" class="bg-black/30 border border-white/10 rounded-lg px-4 py-2 text-sm font-mono focus:outline-none focus:border-amber-500/50 resize-none"></textarea>
+                <textarea name="keys" placeholder="API keys (one per line)" rows="2" class="bg-black/30 border border-white/10 rounded-lg px-4 py-2 text-sm font-mono focus:outline-none focus:border-amber-500/50 resize-none"></textarea>
+                <button type="submit" class="bg-amber-500 hover:bg-amber-400 text-black font-semibold py-2 rounded-lg text-sm">Add Provider</button>
+                <div id="add-result" class="text-sm"></div>
+            </form>
+        </div>
+        <div class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+            <h3 class="text-lg font-semibold mb-4">Registered Providers</h3>
+            <div id="providers-list">Loading...</div>
+        </div>
+    </div>
+    <script>
+    if (!checkAuth()) throw new Error('no auth');
+    async function loadProviders() {
+        const r = await fetch('/admin/providers', {headers: authHeaders()}).then(r => r.json());
+        const el = document.getElementById('providers-list');
+        if (!r.providers || r.providers.length === 0) {
+            el.innerHTML = '<div class="text-slate-500 text-sm">No dynamic providers yet.</div>';
+            return;
+        }
+        let html = '<div class="flex flex-col gap-3">';
+        r.providers.forEach(p => {
+            const keysCount = (p.keys || []).length;
+            const modelsCount = (p.models || []).length;
+            html += `<div class="bg-black/30 border border-white/5 rounded-lg p-4">
+                <div class="flex items-center justify-between mb-2">
+                    <div class="font-semibold">${p.name}</div>
+                    <button onclick="deleteProvider('${p.id}')" class="text-red-400/70 hover:text-red-400 text-xs">Delete</button>
+                </div>
+                <div class="text-xs text-slate-500 font-mono truncate mb-2">${p.base_url}</div>
+                <div class="flex gap-3 text-xs text-slate-400">
+                    <span>🔑 ${keysCount} keys</span>
+                    <span>🤖 ${modelsCount} models</span>
+                </div>
+                <div class="mt-2 flex gap-2">
+                    <button onclick="appendKeyPrompt('${p.id}')" class="text-xs bg-amber-500/20 hover:bg-amber-500/30 text-amber-300 px-2 py-1 rounded">+ Add Key</button>
+                    <button onclick="checkBalance('${p.id}')" class="text-xs bg-blue-500/20 hover:bg-blue-500/30 text-blue-300 px-2 py-1 rounded">💰 Balance</button>
+                </div>
+                <div id="balance-${p.id}" class="mt-2 text-xs hidden"></div>
+            </div>`;
+        });
+        html += '</div>';
+        el.innerHTML = html;
+    }
+    async function deleteProvider(id) {
+        if (!confirm('Delete this provider?')) return;
+        await fetch('/admin/providers/' + id, {method: 'DELETE', headers: authHeaders()});
+        loadProviders();
+    }
+    async function appendKeyPrompt(id) {
+        const k = prompt('Enter new API key:');
+        if (!k) return;
+        const r = await fetch('/admin/providers/' + id + '/keys', {
+            method: 'POST', headers: authHeaders(),
+            body: JSON.stringify({keys: [k]})
+        }).then(r => r.json());
+        alert(r.success ? `Added ${r.added} key(s)` : 'Failed: ' + JSON.stringify(r));
+        loadProviders();
+    }
+    async function checkBalance(id) {
+        const el = document.getElementById('balance-' + id);
+        el.classList.remove('hidden');
+        el.innerHTML = '<span class="text-slate-400">Checking...</span>';
+        const r = await fetch('/admin/balance/check/' + id, {headers: authHeaders()}).then(r => r.json());
+        if (!r.available) {
+            el.innerHTML = `<span class="text-red-400">${r.error || 'Unavailable'}</span>`;
+            return;
+        }
+        el.innerHTML = `<span class="text-green-400">Balance: ${r.balance ?? '?'} ${r.currency || ''} (total: ${r.total ?? '?'}, used: ${r.used ?? '?'})</span>`;
+    }
+    document.getElementById('add-provider-form').addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const f = e.target;
+        const payload = {
+            name: f.name.value.trim(),
+            base_url: f.base_url.value.trim(),
+            balance_endpoint_url: f.balance_endpoint_url.value.trim() || null,
+            models: f.models.value.split('\n').map(s => s.trim()).filter(Boolean),
+            keys: f.keys.value.split('\n').map(s => s.trim()).filter(Boolean),
+        };
+        const r = await fetch('/admin/providers/import', {
+            method: 'POST', headers: authHeaders(),
+            body: JSON.stringify(payload)
+        });
+        const resEl = document.getElementById('add-result');
+        if (r.ok) {
+            resEl.innerHTML = '<span class="text-green-400">✓ Added</span>';
+            f.reset();
+            loadProviders();
+        } else {
+            const j = await r.json().catch(() => ({}));
+            resEl.innerHTML = '<span class="text-red-400">Error: ' + (j.detail?.error?.message || r.status) + '</span>';
+        }
+    });
+    loadProviders();
+    </script>
+    """
+    return HTMLResponse(content=_admin_layout("Providers", "/admin/providers", body, TURNSTILE_SITE_KEY))
+
+
+@app.get("/admin/balance", response_class=HTMLResponse)
+async def admin_balance_page():
+    body = """
+    <div class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+        <div class="flex items-center justify-between mb-4">
+            <h3 class="text-lg font-semibold">Balance Overview</h3>
+            <button id="refresh-all" class="bg-amber-500 hover:bg-amber-400 text-black font-semibold px-4 py-2 rounded-lg text-sm">Refresh All</button>
+        </div>
+        <div id="balance-results"><div class="text-slate-500 text-sm">Click "Refresh All" to check balances.</div></div>
+    </div>
+    <script>
+    if (!checkAuth()) throw new Error('no auth');
+    document.getElementById('refresh-all').addEventListener('click', async () => {
+        const el = document.getElementById('balance-results');
+        el.innerHTML = '<div class="text-slate-400 text-sm">Checking all providers...</div>';
+        const r = await fetch('/admin/balance/check-all', {headers: authHeaders()}).then(r => r.json());
+        if (!r.results || r.results.length === 0) {
+            el.innerHTML = '<div class="text-slate-500 text-sm">No dynamic providers configured.</div>';
+            return;
+        }
+        let html = '<table class="w-full text-sm"><thead><tr class="text-left text-slate-400 text-xs uppercase"><th class="py-2">Provider</th><th class="py-2">Balance</th><th class="py-2">Total</th><th class="py-2">Used</th><th class="py-2">Status</th></tr></thead><tbody>';
+        r.results.forEach(x => {
+            const status = x.available
+                ? '<span class="text-green-400">✓ OK</span>'
+                : '<span class="text-red-400">' + (x.error || 'Error') + '</span>';
+            html += `<tr class="border-t border-white/5">
+                <td class="py-2">${x.provider || x.provider_id}</td>
+                <td class="py-2 font-mono">${x.balance ?? '—'} ${x.currency || ''}</td>
+                <td class="py-2 text-slate-400 font-mono">${x.total ?? '—'}</td>
+                <td class="py-2 text-slate-400 font-mono">${x.used ?? '—'}</td>
+                <td class="py-2">${status}</td>
+            </tr>`;
+        });
+        html += '</tbody></table>';
+        el.innerHTML = html;
+    });
+    </script>
+    """
+    return HTMLResponse(content=_admin_layout("Balance", "/admin/balance", body, TURNSTILE_SITE_KEY))
+
+
+@app.get("/admin/models", response_class=HTMLResponse)
+async def admin_models_page():
+    body = """
+    <div class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+        <div class="flex items-center justify-between mb-4">
+            <h3 class="text-lg font-semibold">Available Models</h3>
+            <span class="text-xs text-slate-500">Models are listed with provider prefixes where applicable</span>
+        </div>
+        <div id="models-list">Loading...</div>
+    </div>
+    <script>
+    if (!checkAuth()) throw new Error('no auth');
+    (async () => {
+        const r = await fetch('/admin/models', {headers: authHeaders()}).then(r => r.json());
+        const el = document.getElementById('models-list');
+        const models = r.models || [];
+        if (models.length === 0) {
+            el.innerHTML = '<div class="text-slate-500 text-sm">No models registered.</div>';
+            return;
+        }
+        let html = '<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-2">';
+        models.forEach(m => {
+            html += `<div class="bg-black/30 border border-white/5 rounded-lg px-3 py-2 text-xs font-mono">${m}</div>`;
+        });
+        html += '</div>';
+        el.innerHTML = html;
+    })();
+    </script>
+    """
+    return HTMLResponse(content=_admin_layout("Models", "/admin/models", body, TURNSTILE_SITE_KEY))
+
+
+@app.get("/admin/settings", response_class=HTMLResponse)
+async def admin_settings_page():
+    body = """
+    <div class="grid md:grid-cols-2 gap-6">
+        <div class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+            <h3 class="text-lg font-semibold mb-4">System Info</h3>
+            <div class="space-y-2 text-sm">
+                <div class="flex justify-between"><span class="text-slate-400">Turnstile:</span><span id="turnstile-status" class="font-mono">...</span></div>
+                <div class="flex justify-between"><span class="text-slate-400">GitHub Gist:</span><span id="gist-status" class="font-mono">...</span></div>
+                <div class="flex justify-between"><span class="text-slate-400">HF Dataset:</span><span class="font-mono">__HF_DATASET__</span></div>
+            </div>
+        </div>
+        <div class="bg-slate-900/30 border border-white/5 rounded-xl p-6">
+            <h3 class="text-lg font-semibold mb-4">Blocked IPs</h3>
+            <div id="blocked-ips" class="space-y-1 text-sm font-mono text-slate-400">
+                __BLOCKED_IPS_HTML__
+            </div>
+        </div>
+    </div>
+    <script>
+    if (!checkAuth()) throw new Error('no auth');
+    document.getElementById('turnstile-status').textContent = '__TURNSTILE_STATUS__';
+    document.getElementById('gist-status').textContent = '__GIST_STATUS__';
+    </script>
+    """
+    body = body.replace("__HF_DATASET__", HF_DATASET or "not configured")
+    body = body.replace("__BLOCKED_IPS_HTML__", "<br>".join(BLOCKED_IPS) if BLOCKED_IPS else "None")
+    body = body.replace("__TURNSTILE_STATUS__", "✓ Configured" if TURNSTILE_SECRET_KEY else "✗ Disabled")
+    body = body.replace("__GIST_STATUS__", "✓ Configured" if (GITHUB_TOKEN and GIST_ID) else "✗ Disabled")
+    return HTMLResponse(content=_admin_layout("Settings", "/admin/settings", body, TURNSTILE_SITE_KEY))
+
+
 # ── Image Generation Endpoint ─────────────────────────────────────────────────
 
 @app.post("/v1/images/generations")