Relayed in memory · never stored or logged
Fill in any OpenAI-compatible base URL and key, and find out whether it actually works — and whether it bills you honestly. Your key is relayed in memory and discarded.
Being precise about the limits matters more than a confident number. Here is what we do not claim.
Only Anthropic's thinking signature is cryptographically verifiable. For OpenAI-shaped APIs there is no server-side proof, so we report signals — never a verdict on authenticity. A passing model check means nothing looked wrong, not that the model is real.
We read the usage field in the response. Your final invoice can also depend on multipliers, cache pricing and group rates that never appear in the API response.
Requests are relayed by HiAPI so that endpoints without CORS headers can still be tested. That means your key passes through our server for the length of the request — in memory only, never written down. If you would rather it did not, run the same calls yourself with the OpenAI SDK.
HiAPI publishes this tool. We do not rank, recommend or blacklist any relay. A report only shows signals reproducible in this one run.
Enter the base URL and key. Leave the model as is, or let Detect models list what the endpoint serves.
The key is relayed to your endpoint and discarded. Nothing is stored, and nothing about you is logged.
A score out of 100, five groups, and the measured value behind every check.
Sign up free, then generate a key in the dashboard.
Point your SDK at the HiAPI base URL and reuse the key above.
Pay as you go. 2,000 credits = $1, with no monthly fee.
Listing models proves the host resolves, TLS completes, the path is right and the key is accepted — before you spend anything on tokens.
A model told to reply OK should not report forty completion tokens. We compare the usage it claims against the reply it sent, and check that max_tokens is honoured.
Buffering relays and broken server-sent events look fine until you measure them. We check the chunk shape, the [DONE] terminator, and how evenly latency holds.
The key is held in this page's memory for the length of the checkup and is discarded when you close the tab. It is never written to localStorage or cookies. Each request is relayed by our server to the base URL you typed, so that endpoints without CORS headers can still be tested; on the server the key exists only for the length of that request and is never written to disk, never logged, and never included in an error message.
Yes. There is nothing for us to bill, and no sign-in is required — the tokens consumed come out of your own key's balance. Requests are relayed through our server in memory, because many endpoints send no CORS headers and cannot be reached from the browser at all. Your key is used for the request and discarded: never stored, never logged.
No, and neither can any tool that only speaks the OpenAI protocol. Anthropic's thinking signature is the one cryptographically verifiable identity signal, and it does not exist for OpenAI-shaped APIs. We report whether the served model name matches what you asked for, which is a weak signal that a gateway can fake.
Because browsers enforce CORS: a server has to explicitly opt in to cross-origin calls, and many relays and self-hosted gateways never send those headers. The request is blocked before it leaves your machine. That is exactly why this checkup relays through our server instead of calling your endpoint directly — the CORS restriction does not apply to a server-side call.
It reaches us, because we relay the request to your endpoint — that is what lets endpoints without CORS headers be tested at all. It is held in memory for the length of the call, never written to disk, never logged, and discarded afterwards. The copied report masks it.
We ask the model for the shortest possible reply and compare how many completion tokens it claims to have produced. Wildly inflated figures mean the number you are billed on does not reflect what was generated. We also check that max_tokens is respected and that repeated identical calls produce stable usage.
Two reasons. A single checkup cannot prove an endpoint is flawless, so the maximum is 98. And a hard cap applies when something fundamental fails: a rejected key caps the score at 35, an unreachable model list at 25, a failed chat call at 45. That stops a broken endpoint from looking decent because the remaining checks happened to pass.