# ai& / aiand provider validation notes

Use these notes for legitimate single-account setup, API-key validation, and Hermes provider configuration for aiand.com. Do **not** use them to automate mass signup, promo abuse, or coupon circumvention.

## Domains and routes

- Marketing site: `https://www.aiand.com/`
- Console: `https://console.aiand.com/`
- API host: `https://api.aiand.com`
- Magic-link verification page: `https://console.aiand.com/verify-magic?token=<uuid>`
- OpenAI-compatible chat endpoint: `https://api.aiand.com/v1/chat/completions`
  - Pitfall: `https://api.aiand.com/api/v1/chat/completions` is the wrong base path for OpenAI-compatible chat probes.

## Email magic-link flow

A login email may contain both a tracked redirect URL and a plain console URL. Prefer the plain URL matching:

```text
https://console.aiand.com/verify-magic?token=<uuid>
```

After navigation, click `Continue sign-in` to establish the browser session.

## Dashboard credit-check flow

For one-account validation:

1. Open `https://console.aiand.com/home`.
2. Read the top-right `Credits: $...` button/state.
3. `Add Credits` opens a `Purchase Credits` dialog.
4. Choose `$50` (or requested amount) and click `Purchase` to reach Stripe checkout.
5. In Stripe, enter the promo in the `Ввести промокод` / promo-code field and verify page text:
   - Success: discount line appears and total becomes zero or expected discounted value.
   - Failure: explicit alert such as `Код недействителен.` means the coupon did not apply for that checkout/account/product/region.

Do not infer success from merely typing the code; verify total and explicit error text.

### Billing-page route nuance

- The docs point to billing at `https://console.aiand.com/settings/billing`, but in practice the same flow is reachable from the Home dashboard via `Add Credits`.
- The purchase dialog commonly shows preset buttons like `$50`, `$150`, `$500` and a `Purchase` button before redirecting to Stripe.
- Browser snapshots around the Stripe transition can briefly come back as `(empty page)` even while `window.location.href` already points at `https://checkout.stripe.com/...`. When that happens, confirm location first, then refresh the snapshot or take a screenshot before concluding the click failed.

### Stripe promo diagnostics notes

- Observed Stripe checkout for aiand `Platform Credits` may localize to Russian; the promo field label can be `Ввести промокод`, the apply button `Применить`, and rejection text `Код недействителен.`
- On a valid browser session, the `$50` credit purchase flow reaches Stripe correctly even when the coupon fails. A Stripe rejection means the issue is coupon eligibility/configuration, not browser automation or field selection.
- Treat `Код недействителен.` / invalid-code alerts as a hard diagnostic result for that checkout: likely expired/disabled coupon, wrong product/price, region/currency restriction, or customer-specific coupon. Do not retry across many accounts as a workaround.
- Clicking `Purchase` to reach Stripe can create an unpaid checkout/invoice state; do not enter payment details or complete the payment during diagnostics unless the user explicitly intends to pay. Use the merchant back link to exit.

## API-key validation classification

Use a minimal chat/completions request against `/v1/chat/completions` with a known model id. Interpret results carefully:

- `200 OK`: key, org routing, endpoint, and selected model are usable.
- `insufficient_credits`: key authentication succeeded, but org/account balance is zero.
- `No access token` / 401-like: missing, truncated, or wrong bearer token, or wrong auth header.
- Model-not-found errors: auth may still be valid; retry with a known aiand model.
- Cloudflare `Error 1010: Access denied` / `browser's signature`: not necessarily an auth failure. Python HTTP clients such as `urllib` and `aiohttp` are blocked by Cloudflare while the same key succeeds through system `curl`. Re-test with curl before concluding the token is bad. For any Python tool that needs to talk to aiand API, use `subprocess.run(["curl", ...])` instead of `requests`/`aiohttp`/`urllib`.

### Actual model availability (2026-07-09)

`GET /v1/models` returns 7 models, but only 1 actually works on a $0-balance account:

| Model | Status | Notes |
|---|---|---|
| `qwen/qwen3.6-27b` | ✅ Works | **Reasoning model** — output in `reasoning` field, `content` is null. Free tier. |
| `deepseek-ai/deepseek-v4-pro` | ❌ Needs credits | Returns `insufficient_credits` |
| `deepseek-ai/deepseek-v4-flash` | ❌ Needs credits | Returns `insufficient_credits` |
| `zai-org/glm-5.2` | ❌ Not on host | Returns `does not exist` |
| `moonshotai/kimi-k2.7-code` | ❌ Not on host | Returns `does not exist` |
| `google/gemma-4-31b-it` | ❌ Not on host | Returns `does not exist` |
| `openai/gpt-oss-120b` | ❌ Not on host | Returns `does not exist` |

Note: `moonshotai/kimi-k2.6` is NOT in the `/v1/models` response (7 models, not 8).

### qwen/qwen3.6-27b reasoning model quirk

This model is a reasoning model running on vLLM. The output is in `choices[0].message.reasoning` — NOT `choices[0].message.content` which is `null`. The model uses `finish_reason: "length"` when `max_tokens` is hit. Always check BOTH fields when parsing responses:

```python
msg = data["choices"][0]["message"]
txt = msg.get("content") or msg.get("reasoning", "")
```

Stress test results (2026-07-09): 108/108 requests OK, 6.8 req/s throughput, avg latency 5.73s, p50 4.94s, 204 tok/s total TPS. Multi-key concurrent requests work without rate limiting.

For bulk key files, prefer the bundled curl-based checker:

```bash
python scripts/aiand_check_keys_curl.py --keys C:/path/to/aiand_keys.txt --out aiand_key_report.csv
```

Parsing pitfalls:

- Current observed key rows may be `email|sk-...|org_id`; do not split once and treat `sk-...|org_id` as the bearer token.
- Select the first field beginning with `sk-` as the API key and the UUID-like non-email field as `X-Org-ID`.
- Never log raw keys; print email/line, key length, status, and HTTP status only.

Known model ids observed in the console/pricing table include:

- `zai-org/glm-5.2`
- `moonshotai/kimi-k2.7-code`
- `moonshotai/kimi-k2.6`
- `qwen/qwen3.6-27b`
- `deepseek-ai/deepseek-v4-pro`
- `deepseek-ai/deepseek-v4-flash`
- `google/gemma-4-31b-it`
- `openai/gpt-oss-120b`

## Session timeout pitfall

The aiand console session (established via magic link) expires aggressively — often within **5-10 minutes** of inactivity. After expiry, any navigation (`console.aiand.com/*`) redirects to `/login` with an empty page. The browser snapshot shows only `region "Notifications alt+T"` with no interactive elements.

**Workflow impact**: When doing browser-based promo code validation or credit checks, the entire flow (login → magic link → navigate → add credits → Stripe → promo code) must complete within one session window. If the session dies mid-flow, request a fresh magic link via IMAP (`execute_code` with `imaplib` is fastest) and restart.

**Detection**: A snapshot showing only `region "Notifications alt+T"` and no navigation/content elements means the session is dead. Do not try to interact — go straight to requesting a new magic link.

**Fastest re-login**: Use `execute_code` to pull the latest magic link from IMAP, then `browser_navigate` directly to the `verify-magic?token=` URL. This is faster than re-entering email on the login form.

## Security hygiene

If an email app password or provider key is found hardcoded in a script, move it to `.env`/environment variables and recommend rotating it. Do not preserve raw secrets in skill references.