Developer builds unified API gateway routing across 16 Chinese LLMs with one key

·1 views

A developer team has launched HOUJIAYAN API, a unified OpenAI-compatible gateway that provides access to 16 Chinese large language models — including DeepSeek, Kimi, Qwen, MiniMax, and Doubao — through a single endpoint and API key. The platform was built to remove friction for international developers who face incompatible authentication systems, inconsistent billing, and mainland-China-only payment requirements across individual providers. The architecture uses a forked version of the open-source NewAPI gateway layered with Cloudflare for security, a custom smart router that automatically selects models across quality, balanced, or cost tiers, and a standalone payment bridge supporting both WeChat Pay and USDT-TRC20 via NOWPayments. Pricing is set to match official upstream rates with no markup, starting as low as ¥1.00 per million tokens. The team published architecture notes detailing key engineering challenges, including WeChat's newer public-key verification mode and inconsistent token usage reporting across upstream providers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Clean Invalid Emails and Protect Your Email Deliverability

Businesses accumulate data debt over time, including outdated or invalid user email addresses that can harm email deliverability and sender reputation. A practical approach involves sending a policy-update email announcing a 12-month inactivity deletion policy, which simultaneously helps identify bounced or invalid addresses. Bounce reports from this campaign can be exported to flag users with bad emails, who can then be permanently deleted if also inactive. Active users with invalid emails should be prompted through in-app notifications or embedded verification links to update their contact details. Keeping email lists clean improves delivery rates, reduces spam risk, and ensures compliance with data privacy standards.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Routine Patch Update Broke an Enterprise Angular App in 2017

A developer recounts a 2017 incident where a minor patch-version upgrade unexpectedly broke a large enterprise Angular application used to monitor Fair Trade certified products globally. The app needed to support multiple languages with runtime switching, a feature Angular's early i18n system did not natively support at the time. To work around this, the team built a custom solution that scanned the page for elements marked with the i18n attribute and swapped in the correct translations on language change. A routine patch update to Angular disrupted this homegrown approach, revealing how tightly their workaround was coupled to the framework's internal behavior. The developer notes the fault lay not with Angular itself, but with assumptions baked into their own custom implementation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Duplicate Email Checks Create Silent Data Conflicts in User Systems

A developer discovered that their signup flow verified users twice — once via a typed OTP code and again through an auth service confirmation link — without either check being aware of the other. Users who completed the OTP step were immediately signed in, making the second confirmation email redundant and easy to ignore. This left accounts in a state where one record showed email ownership proven while another flagged it as unconfirmed, creating a silent contradiction in the database. The auth service's confirmation email was a platform default that had never been disabled after the team built their own OTP-based verification flow. The core lesson drawn is that two separate records of the same fact will eventually diverge, and any system or future feature reading only one of them will silently reach the wrong conclusion.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Researchers Find 24 Vulnerability Patterns Across 10 Major AI Agent Frameworks

A security research team conducted a 90-day audit of ten major AI frameworks — including CrewAI, AutoGen, LlamaIndex, and Dify — uncovering 24 distinct vulnerability patterns in production LLM systems. The study found that over 60% of MCP server implementations lack basic access controls, allowing any connected client to invoke registered tools including destructive operations. High-severity flaws such as path traversal, SQL injection, SSRF, and tool parameter injection were confirmed in projects from major tech firms including Ant Group, Tencent, ByteDance, and DeepSeek. The team's custom scanner, validated against 80,000 API traces across 13 providers and 33 models, is designed for real-time deployment as a runtime guardrail. All confirmed vulnerabilities were responsibly disclosed through platforms including HackerOne, Bugcrowd, and MSRC, with the team reporting 100% submission pipeline automation.

0 comments Read more at DEV Community