Use your own model

Run Hermes on Pusk with your own OpenRouter key: a forkable kit with an LLM proxy you host, a revocable token per instance, per-instance spend caps, and real per-instance cost tracking.

Every instance boots with a managed model: zero setup, and Pusk meters the spend from your wallet against each instance's budget. When you'd rather own the model layer (your OPENROUTER_API_KEY, your choice of models, your own per-user metering and limits), the hermes-byo-model kit is the supported path. It's a complete forkable app in which every Hermes turn runs on your OpenRouter account, through a proxy hosted in your own app.

Managed model or your own?

Compute is billed the same either way: an instance is a computer, whoever's model it calls.

How it works

agent instance (Hermes on Pusk Cloud)
  └─ ~/.hermes/config.yaml → custom provider: https://your-app.com/api/llm/v1
       api_key: orp_…   (a per-agent token, worthless anywhere else)
        └─ your app: token → agent → month-to-date spend vs that agent's cap
             402 when the agent is over budget; the agent says so in chat
             forward to OpenRouter with your key, usage accounting on
             read the real cost off the reply (SSE included) → Postgres
                └─ OpenRouter → Claude / GPT / Kimi / Gemini / …

• Your key stays home. The instance holds only a revocable per-agent token; the OpenRouter key lives in your app's environment and never reaches an instance or the browser. Rotating a token is a button in the kit's Settings tab.
• Per-agent budgets, enforced before the call. Each agent carries a monthly cap. The proxy checks month-to-date spend first and refuses with 402 when it's reached, and the agent surfaces that as a plain message in chat rather than failing silently.
• Real cost, not estimates. The proxy asks OpenRouter to include usage accounting and records the dollars it reports, per agent, per model, per day. That table is what you'd invoice your own users from.
• The clean base image. The kit registers a workspace template on Pusk's hermes-base image, which boots with no model provider at all, so the config the app writes is the only one the agent has. The stock pusk-hermes template re-wires the managed model at every boot, which would leave a second, Pusk-billed model sitting in the picker.

Get started

1. Get your keys

   Three secrets, each behind a login: an sk_live_ API key from a funded workspace (see Billing), an OPENROUTER_API_KEY from openrouter.ai/settings/keys with credit on it, and a Supabase access token; the kit provisions a free Supabase project for you.

2. Clone it

   git clone https://github.com/pusk-platform/hermes-byo-model
   cd hermes-byo-model
   

3. Run setup

   The fastest path is agent-driven: open the folder in Claude Code or Codex and paste the setup prompt from the README. It asks for your three keys, provisions Supabase, and registers the agent template in your workspace.

   By hand: npm install, then npm run setup twice. The first run creates .env.local and exits asking for the keys; paste them in and run it again, then run npm run templates:publish.

4. Run it

   npm run dev
   

   Open http://localhost:3000, sign up, and create an agent. Agents run on Pusk Cloud and call your app for every turn, so the app needs a public URL: npm run dev opens a free cloudflared quick tunnel automatically (it needs the cloudflared binary, brew install cloudflared, but no Cloudflare account), and in production it's just your deployed URL. Creating an agent without one is refused, rather than producing an agent with no way to think.

The first turn takes a minute: a new agent is configured over exec and restarted before it answers. After that, the agent's Settings tab shows what each conversation cost you within seconds of the reply.

What you get

The kit is the Pusk white-label dashboard with the model layer swapped: the same multi-tenant app (email sign-in, workspaces, instance management, native Chat and Files tabs) plus a per-agent model budget, live spend on your OpenRouter account, and a token you can rotate. The chat model picker lists every model your key can reach; a one-line allow-list in src/config/models.ts narrows that to the models you approve, enforced in the proxy rather than trusted in the UI. Fork it, rebrand it (src/config/branding.ts), and ship it.