Blog

RedRouter API quickstart: a key, a curl and the OpenAI SDK

By the RedRouter Team · Tested October 27, 2026
August 31, 2026

Set base_url to https://redrouter.org/v1, send your RedRouter key as a bearer token, and pick one of the model IDs below. That is the whole integration for any OpenAI-compatible client.

export REDROUTER_API_KEY="YOUR_REDROUTER_API_KEY"

curl https://redrouter.org/v1/chat/completions \
  -H "Authorization: Bearer $REDROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-5.3-flash-rr",
    "max_tokens": 4096,
    "messages": [{"role": "user", "content": "Explain what CVE-2024-3094 changed in liblzma."}]
  }'

Run on October 27, 2026. glm-5.3-flash-rr returned (trimmed):

# CVE-2024-3094: The xz Utils Backdoor

CVE-2024-3094 is the vulnerability identifier for the **malicious supply-chain backdoor** discovered in xz Utils (versions 5.6.0 and 5.6.1) in late March 2024. It's notable not as a software bug, but as an elaborate, intentional attack inserted by the maintainer's "assistant" (Jia Tan / "JiaT75") over years of social engineering.

## What was actually changed in liblzma

The backdoor was **not** inserted directly into the liblzma source code in any obvious way. Instead, it was hidden in the build system:

### 1. Malicious files disguised as test data
The upstream xz-utils Git repository did not contain the malicious code. Instead, the **release tarballs** (xz-5.6.0.tar.gz and xz-5.6.1.tar.gz) contained two extra files not present in the public Git repo:

- `tests/files/bad-3-corrupt_lzma2.xz`
- `tests/files/good-large_compressed.lzma`

These masqueraded as test fixture files, so they looked innocuous.

### 2. Modified build scripts injecting hidden code
The tarballs also contained modified versions of:

[Response trimmed here.]

Get a key

1. Sign up with your email address. RedRouter never asks for identity documents.
2. Add credits on the Credits page. A top-up is at least $10, by card or USDC, and top-up credit never expires. Monthly plans ($20, $50 or $200) include the same amount of credit at standard rates, which expires at the end of each period and is spent first.
3. Create a key on the API Keys page. The secret is shown once. You can give each key a credit limit, an expiry date and a model allowlist.

During the paid beta, card payments need a US billing address and a US-issued card, and USDC needs a US billing address.

Models and prices

Every request names one model. RedRouter does not route to a different model or fall back to one when yours is busy.

Prices are USD per million tokens. Cached input is billed at the cached rate only when a cache read is reported. Turning on Zero Data Retention for your account adds 20% to every rate.

All four models accept up to about a million tokens of context and return at most 8,192 output tokens per request. Each model page has the details: GLM 5.3 RR, GLM 5.3 Flash RR, Qwen 3.8 27B RR and DeepSeek V4.1 Flash RR.

Python

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://redrouter.org/v1",
    api_key=os.environ["REDROUTER_API_KEY"],
)
response = client.chat.completions.create(
    model="deepseek-v4.1-flash-rr",
    max_tokens=4096,
    messages=[{"role": "user", "content": "Write a Sigma rule for a new local admin account on Windows."}],
)
print(response.choices[0].message.content)

Node

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://redrouter.org/v1",
  apiKey: process.env.REDROUTER_API_KEY,
});
const response = await client.chat.completions.create({
  model: "qwen3.8-27b-rr",
  max_tokens: 4096,
  messages: [{ role: "user", content: "Summarize the attack surface of a default Jenkins install." }],
});
console.log(response.choices[0].message.content);

Both ran on October 27, 2026, with the openai Python package 3.40.0 and the openai Node package 7.45.1. The Python request returned a Sigma rule for Windows event ID 4732; the Node request returned a Jenkins attack-surface summary. No code change was needed beyond the base URL and key.

Streaming and tools

Add "stream": true to get server-sent events. Add "stream_options": {"include_usage": true} if you want token usage in the last chunk. A request without streaming has a 110-second deadline and returns 504 when it runs out, so stream anything long. An idle stream gets a keepalive every 15 seconds.

All four models accept tools and tool_choice. RedRouter never runs your tools; your code executes each call and sends the result back. A request can declare up to 128 functions.

Anthropic Messages

RedRouter also answers the Anthropic Messages API at https://redrouter.org/v1/messages, which is what Claude Code and other Anthropic-format clients use. It accepts text and tool blocks. Images, documents and server tools return 400, and token counting returns 404. The agent setup guide has the Claude Code configuration.

Limits

A new account can send 60 requests a minute with 4 in flight, and spend up to $50 a day. Limits rise with purchased credit: from $100, 300 requests a minute, 10 concurrent and $500 a day; from $500, 1,000 a minute, 25 concurrent and $2,500 a day. New purchases count toward a tier after 72 hours. A monthly plan sets its tier straight away. Request bodies are capped at 1 MiB.

Errors you will see

Before each request, RedRouter holds enough credit to cover its maximum cost, charges the reported usage, and releases the rest. If a stream drops before usage arrives, the request waits in reconciliation; RedRouter does not invent a token count.

What you agree to

These models refuse less, so the terms put the responsibility on you. Testing systems you do not own or are not authorized to test is not allowed. By default, RedRouter keeps an encrypted copy of prompts and completions for up to 30 days for abuse prevention, support, debugging and billing disputes. With Zero Data Retention on, it stores no prompt or completion content. The privacy policy has the details.

This is for authorized security work: pentesters, red teams, and people building security tooling and agents, who need a model that will write the exploit, the YARA rule or the parser instead of refusing. Point an OpenAI-compatible client at it and the four models above behave like any other chat endpoint.