Files
chenchen 80d0f956d0 feat(manager): P0 device-binding signature layer for cc-haha desktop clients
Lays down the server side of a per-request Ed25519 signature scheme that
binds a token to a specific desktop install, so the bearer key can't be
extracted from ~/.claude/cc-haha/providers.json and resold. Plan lives
at ~/.claude/plans/peaceful-sprouting-crane.md.

Compatibility: legacy bare-bearer sk- callers (CLI/SDK) pass through
unchanged until P3 (30-day deadline) flips RequireGlobal=true. No
existing token rows are modified — pubkey is nullable and defaults to
null.

Pieces:
- model.Token gains DeviceId, DevicePubkey, DeviceFingerprint, DeviceName,
  DevicePlatform, DeviceAppVersion, DeviceBoundAt, DeviceLastSeenIp,
  DeviceLastUsedAt, RequireDeviceBinding, RevokedAt, RevokedReason.
  Pure additive columns, GORM AutoMigrate handles SQLite/MySQL/PG.
- common.VerifyEd25519Signature: thin wrapper around crypto/ed25519
  stdlib, used by the new middleware. No new external deps.
- service.MarkNonceUsed: Redis SETNX-based nonce store with an
  in-memory sync.Map fallback for single-instance dev. TTL = setting.
- middleware.VerifyDeviceSignatureIfRequired: wired into TokenAuth as
  a fail-fast dispatch right after model.ValidateUserToken. Verifies
  canonical = METHOD\nPATH\nTS_MS\nNONCE\nFINGERPRINT\nSHA256(BODY),
  signed as Ed25519(sha256(canonical)). 120s timestamp window, 300s
  nonce window, fingerprint stored at pair time must match the header.
- controller.PairDevice / ListUserDevices / RenameUserDevice /
  RevokeUserDevice, mounted at /api/devices/* behind UserAuth().
  PairDevice enforces 5-per-user cap and returns the raw sk- once,
  to be stored in the client's OS keychain (not providers.json).
- operation_setting.DeviceBindingSetting: MaxDevicesPerUser=5,
  TimestampWindowMs=120000, NonceTTLSec=300, RequireGlobal=false.

Tests:
- common/crypto_test.go covers round-trip + tamper + malformed inputs.
- middleware/device_signature_test.go covers all error-path branches
  (expired ts, wrong sig, tampered body, fingerprint mismatch, replay,
  revoked, missing headers, legacy fallthrough).
- testdata/device_signature_vectors.json is the cross-language contract
  Rust+TS sides will load to assert byte-identical canonical strings.

Untouched but reserved for follow-up phases:
- Anomaly detection / IP-diversity flagging (P1)
- 30-day deprecation banner + email notifications (P2)
- Hard cutover RequireGlobal=true (P3, day 31)
2026-05-20 12:10:57 +08:00
..
2026-05-18 18:15:05 +08:00

heicode

New API

🍥 Next-Generation Large Model Gateway and AI Asset Management System

中文 | English | Français | 日本語

license release docker docker GoReportCard

Calcium-Ion%2Fheicode | Trendshift

Quick Start • Key Features • Deployment • Documentation • Help

📝 Project Description

Note

This is an open-source project developed based on One API

Important


🤝 Trusted Partners

No particular order

Cherry Studio Peking University UCloud Alibaba Cloud IO.NET


🙏 Special Thanks

JetBrains Logo

Thanks to JetBrains for providing free open-source development license for this project


🚀 Quick Start

# Clone the project
git clone https://github.com/QuantumNous/heicode.git
cd heicode

# Edit docker-compose.yml configuration
nano docker-compose.yml

# Start the service
docker-compose up -d
Using Docker Commands
# Pull the latest image
docker pull calciumion/heicode:latest

# Using SQLite (default)
docker run --name heicode -d --restart always \
  -p 3000:3000 \
  -e TZ=Asia/Shanghai \
  -v ./data:/data \
  calciumion/heicode:latest

# Using MySQL
docker run --name heicode -d --restart always \
  -p 3000:3000 \
  -e SQL_DSN="root:123456@tcp(localhost:3306)/oneapi" \
  -e TZ=Asia/Shanghai \
  -v ./data:/data \
  calciumion/heicode:latest

💡 Tip: -v ./data:/data will save data in the data folder of the current directory, you can also change it to an absolute path like -v /your/custom/path:/data


🎉 After deployment is complete, visit http://localhost:3000 to start using!

📖 For more deployment methods, please refer to Deployment Guide


📚 Documentation

Quick Navigation:

Category Link
🚀 Deployment Guide Installation Documentation
⚙️ Environment Configuration Environment Variables
📡 API Documentation API Documentation
❓ FAQ FAQ
💬 Community Interaction Communication Channels

✨ Key Features

For detailed features, please refer to Features Introduction

🎨 Core Functions

Feature Description
🎨 New UI Modern user interface design
🌍 Multi-language Supports Chinese, English, French, Japanese
🔄 Data Compatibility Fully compatible with the original One API database
📈 Data Dashboard Visual console and statistical analysis
🔒 Permission Management Token grouping, model restrictions, user management

💰 Payment and Billing

  • ✅ Online recharge (EPay, Stripe)
  • ✅ Pay-per-use model pricing
  • ✅ Cache billing support (OpenAI, Azure, DeepSeek, Claude, Qwen and all supported models)
  • ✅ Flexible billing policy configuration

🔐 Authorization and Security

  • 😈 Discord authorization login
  • 🤖 LinuxDO authorization login
  • 📱 Telegram authorization login
  • 🔑 OIDC unified authentication

🚀 Advanced Features

API Format Support:

Intelligent Routing:

  • ⚖️ Channel weighted random
  • 🔄 Automatic retry on failure
  • 🚦 User-level model rate limiting

Format Conversion:

  • 🔄 OpenAI Compatible ⇄ Claude Messages
  • 🔄 OpenAI Compatible → Google Gemini
  • 🔄 Google Gemini → OpenAI Compatible - Text only, function calling not supported yet
  • 🚧 OpenAI Compatible ⇄ OpenAI Responses - In development
  • 🔄 Thinking-to-content functionality

Reasoning Effort Support:

View detailed configuration

OpenAI series models:

  • o3-mini-high - High reasoning effort
  • o3-mini-medium - Medium reasoning effort
  • o3-mini-low - Low reasoning effort
  • gpt-5-high - High reasoning effort
  • gpt-5-medium - Medium reasoning effort
  • gpt-5-low - Low reasoning effort

Claude thinking models:

  • claude-3-7-sonnet-20250219-thinking - Enable thinking mode

Google Gemini series models:

  • gemini-2.5-flash-thinking - Enable thinking mode
  • gemini-2.5-flash-nothinking - Disable thinking mode
  • gemini-2.5-pro-thinking - Enable thinking mode
  • gemini-2.5-pro-thinking-128 - Enable thinking mode with thinking budget of 128 tokens
  • You can also append -low, -medium, or -high to any Gemini model name to request the corresponding reasoning effort (no extra thinking-budget suffix needed).

🤖 Model Support

For details, please refer to API Documentation - Relay Interface

Model Type Description Documentation
🤖 OpenAI GPTs gpt-4-gizmo-* series -
🎨 Midjourney-Proxy Midjourney-Proxy(Plus) Documentation
🎵 Suno-API Suno API Documentation
🔄 Rerank Cohere, Jina Documentation
💬 Claude Messages format Documentation
🌐 Gemini Google Gemini format Documentation
🔧 Dify ChatFlow mode -
🎯 Custom Supports complete call address -

📡 Supported Interfaces

View complete interface list

🚢 Deployment

Tip

Latest Docker image: calciumion/heicode:latest

📋 Deployment Requirements

Component Requirement
Local database SQLite (Docker must mount /data directory)
Remote database MySQL ≥ 5.7.8 or PostgreSQL ≥ 9.6
Container engine Docker / Docker Compose

⚙️ Environment Variable Configuration

Common environment variable configuration
Variable Name Description Default Value
SESSION_SECRET Session secret (required for multi-machine deployment) -
CRYPTO_SECRET Encryption secret (required for Redis) -
SQL_DSN Database connection string -
REDIS_CONN_STRING Redis connection string -
STREAMING_TIMEOUT Streaming timeout (seconds) 300
STREAM_SCANNER_MAX_BUFFER_MB Max per-line buffer (MB) for the stream scanner; increase when upstream sends huge image/base64 payloads 64
MAX_REQUEST_BODY_MB Max request body size (MB, counted after decompression; prevents huge requests/zip bombs from exhausting memory). Exceeding it returns 413 32
AZURE_DEFAULT_API_VERSION Azure API version 2025-04-01-preview
ERROR_LOG_ENABLED Error log switch false
PYROSCOPE_URL Pyroscope server address -
PYROSCOPE_APP_NAME Pyroscope application name heicode
PYROSCOPE_BASIC_AUTH_USER Pyroscope basic auth user -
PYROSCOPE_BASIC_AUTH_PASSWORD Pyroscope basic auth password -
PYROSCOPE_MUTEX_RATE Pyroscope mutex sampling rate 5
PYROSCOPE_BLOCK_RATE Pyroscope block sampling rate 5
HOSTNAME Hostname tag for Pyroscope heicode

📖 Complete configuration: Environment Variables Documentation

🔧 Deployment Methods

Method 1: Docker Compose (Recommended)
# Clone the project
git clone https://github.com/QuantumNous/heicode.git
cd heicode

# Edit configuration
nano docker-compose.yml

# Start service
docker-compose up -d
Method 2: Docker Commands

Using SQLite:

docker run --name heicode -d --restart always \
  -p 3000:3000 \
  -e TZ=Asia/Shanghai \
  -v ./data:/data \
  calciumion/heicode:latest

Using MySQL:

docker run --name heicode -d --restart always \
  -p 3000:3000 \
  -e SQL_DSN="root:123456@tcp(localhost:3306)/oneapi" \
  -e TZ=Asia/Shanghai \
  -v ./data:/data \
  calciumion/heicode:latest

💡 Path explanation:

  • ./data:/data - Relative path, data saved in the data folder of the current directory
  • You can also use absolute path, e.g.: /your/custom/path:/data
Method 3: BaoTa Panel
  1. Install BaoTa Panel (≥ 9.2.0 version)
  2. Search for New-API in the application store
  3. One-click installation

📖 Tutorial with images

⚠️ Multi-machine Deployment Considerations

Warning

  • Must set SESSION_SECRET - Otherwise login status inconsistent
  • Shared Redis must set CRYPTO_SECRET - Otherwise data cannot be decrypted

🔄 Channel Retry and Cache

Retry configuration: Settings → Operation Settings → General Settings → Failure Retry Count

Cache configuration:

  • REDIS_CONN_STRING: Redis cache (recommended)
  • MEMORY_CACHE_ENABLED: Memory cache

Upstream Projects

Project Description
One API Original project base
Midjourney-Proxy Midjourney interface support

Supporting Tools

Project Description
neko-api-key-tool Key quota query tool
heicode-horizon New API high-performance optimized version

💬 Help Support

📖 Documentation Resources

Resource Link
📘 FAQ FAQ
💬 Community Interaction Communication Channels
🐛 Issue Feedback Issue Feedback
📚 Complete Documentation Official Documentation

🤝 Contribution Guide

Welcome all forms of contribution!

  • 🐛 Report Bugs
  • 💡 Propose New Features
  • 📝 Improve Documentation
  • 🔧 Submit Code

🌟 Star History

Star History Chart


💖 Thank you for using New API

If this project is helpful to you, welcome to give us a ⭐️ Star!

Official Documentation • Issue Feedback • Latest Release

Built with ❤️ by QuantumNous