ai& / aiand provider validation notes

Use these notes for legitimate single-account setup, API-key validation, and Hermes provider configuration for aiand.com. Do not use them to automate mass signup, promo abuse, or coupon circumvention.

Domains and routes

Marketing site: https://www.aiand.com/
Console: https://console.aiand.com/
API host: https://api.aiand.com
Magic-link verification page: https://console.aiand.com/verify-magic?token=<uuid>
OpenAI-compatible chat endpoint: https://api.aiand.com/v1/chat/completions
- Pitfall: https://api.aiand.com/api/v1/chat/completions is the wrong base path for OpenAI-compatible chat probes.

Email magic-link flow

A login email may contain both a tracked redirect URL and a plain console URL. Prefer the plain URL matching:

https://console.aiand.com/verify-magic?token=<uuid>

After navigation, click Continue sign-in to establish the browser session.

Dashboard credit-check flow

For one-account validation:

Open https://console.aiand.com/home.
Read the top-right Credits: $... button/state.
Add Credits opens a Purchase Credits dialog.
Choose $50 (or requested amount) and click Purchase to reach Stripe checkout.
In Stripe, enter the promo in the Ввести промокод / promo-code field and verify page text:
- Success: discount line appears and total becomes zero or expected discounted value.
- Failure: explicit alert such as Код недействителен. means the coupon did not apply for that checkout/account/product/region.

Do not infer success from merely typing the code; verify total and explicit error text.

Billing-page route nuance

The docs point to billing at https://console.aiand.com/settings/billing, but in practice the same flow is reachable from the Home dashboard via Add Credits.
The purchase dialog commonly shows preset buttons like $50, $150, $500 and a Purchase button before redirecting to Stripe.
Browser snapshots around the Stripe transition can briefly come back as (empty page) even while window.location.href already points at https://checkout.stripe.com/.... When that happens, confirm location first, then refresh the snapshot or take a screenshot before concluding the click failed.

Observed Stripe checkout for aiand Platform Credits may localize to Russian; the promo field label can be Ввести промокод, the apply button Применить, and rejection text Код недействителен.
On a valid browser session, the $50 credit purchase flow reaches Stripe correctly even when the coupon fails. A Stripe rejection means the issue is coupon eligibility/configuration, not browser automation or field selection.
Treat Код недействителен. / invalid-code alerts as a hard diagnostic result for that checkout: likely expired/disabled coupon, wrong product/price, region/currency restriction, or customer-specific coupon. Do not retry across many accounts as a workaround.
Clicking Purchase to reach Stripe can create an unpaid checkout/invoice state; do not enter payment details or complete the payment during diagnostics unless the user explicitly intends to pay. Use the merchant back link to exit.

API-key validation classification

Use a minimal chat/completions request against /v1/chat/completions with a known model id. Interpret results carefully:

200 OK: key, org routing, endpoint, and selected model are usable.
insufficient_credits: key authentication succeeded, but org/account balance is zero.
No access token / 401-like: missing, truncated, or wrong bearer token, or wrong auth header.
Model-not-found errors: auth may still be valid; retry with a known aiand model.
Cloudflare Error 1010: Access denied / browser's signature: not necessarily an auth failure. Python HTTP clients such as urllib and aiohttp are blocked by Cloudflare while the same key succeeds through system curl. Re-test with curl before concluding the token is bad. For any Python tool that needs to talk to aiand API, use subprocess.run(["curl", ...]) instead of requests/aiohttp/urllib.

Actual model availability (2026-07-09)

GET /v1/models returns 7 models, but only 1 actually works on a $0-balance account:

Model	Status	Notes
`qwen/qwen3.6-27b`	✅ Works	Reasoning model — output in `reasoning` field, `content` is null. Free tier.
`deepseek-ai/deepseek-v4-pro`	❌ Needs credits	Returns `insufficient_credits`
`deepseek-ai/deepseek-v4-flash`	❌ Needs credits	Returns `insufficient_credits`
`zai-org/glm-5.2`	❌ Not on host	Returns `does not exist`
`moonshotai/kimi-k2.7-code`	❌ Not on host	Returns `does not exist`
`google/gemma-4-31b-it`	❌ Not on host	Returns `does not exist`
`openai/gpt-oss-120b`	❌ Not on host	Returns `does not exist`

Note: moonshotai/kimi-k2.6 is NOT in the /v1/models response (7 models, not 8).

qwen/qwen3.6-27b reasoning model quirk

This model is a reasoning model running on vLLM. The output is in choices[0].message.reasoning — NOT choices[0].message.content which is null. The model uses finish_reason: "length" when max_tokens is hit. Always check BOTH fields when parsing responses:

msg = data["choices"][0]["message"]
txt = msg.get("content") or msg.get("reasoning", "")

Stress test results (2026-07-09): 108/108 requests OK, 6.8 req/s throughput, avg latency 5.73s, p50 4.94s, 204 tok/s total TPS. Multi-key concurrent requests work without rate limiting.

For bulk key files, prefer the bundled curl-based checker:

python scripts/aiand_check_keys_curl.py --keys C:/path/to/aiand_keys.txt --out aiand_key_report.csv

Parsing pitfalls:

Current observed key rows may be email|sk-...|org_id; do not split once and treat sk-...|org_id as the bearer token.
Select the first field beginning with sk- as the API key and the UUID-like non-email field as X-Org-ID.
Never log raw keys; print email/line, key length, status, and HTTP status only.

Known model ids observed in the console/pricing table include:

zai-org/glm-5.2
moonshotai/kimi-k2.7-code
moonshotai/kimi-k2.6
qwen/qwen3.6-27b
deepseek-ai/deepseek-v4-pro
deepseek-ai/deepseek-v4-flash
google/gemma-4-31b-it
openai/gpt-oss-120b

Session timeout pitfall

The aiand console session (established via magic link) expires aggressively — often within 5-10 minutes of inactivity. After expiry, any navigation (console.aiand.com/*) redirects to /login with an empty page. The browser snapshot shows only region "Notifications alt+T" with no interactive elements.

Workflow impact: When doing browser-based promo code validation or credit checks, the entire flow (login → magic link → navigate → add credits → Stripe → promo code) must complete within one session window. If the session dies mid-flow, request a fresh magic link via IMAP (execute_code with imaplib is fastest) and restart.

Detection: A snapshot showing only region "Notifications alt+T" and no navigation/content elements means the session is dead. Do not try to interact — go straight to requesting a new magic link.

Fastest re-login: Use execute_code to pull the latest magic link from IMAP, then browser_navigate directly to the verify-magic?token= URL. This is faster than re-entering email on the login form.

Security hygiene

If an email app password or provider key is found hardcoded in a script, move it to .env/environment variables and recommend rotating it. Do not preserve raw secrets in skill references.

7.6 KiB Raw Blame History