[playgrndlabs-bot]

Requested by PlaygrndLabs · project thread

Third of the "more providers" PRs (phase 3) for free/.

What changes

• Kimi's OAuth device flow, as in CPA. oauth/auth-url?provider=kimi (or kimi-ai, or &domain=kimi.ai) asks Kimi for a device code and answers in CPA's shape: {status, url, state, flow: "device", user_code, expires_in}. Each oauth/status poll from the dashboard asks Kimi once, and never sooner than the interval Kimi sets, including slow_down. The sign-in finishes on that poll. No background loop is needed on Workers.
• Logins are saved as CPA's kimi-*.json and kimi-ai-*.json auth files and refreshed by the Durable Object. When Kimi refuses a refresh token, the file is marked "token expired".
• Requests: Claude Code (/v1/messages), OpenAI Chat and OpenAI Responses clients all reach Kimi untranslated, at api.kimi.com/coding/v1/... (or api.kimi.ai). Model names follow CPA's mapping (kimi-k3 → k3, kimi-k2.8 → kimi-for-coding, [1m] dropped). A 401 gets the token refreshed.
• Model lists: CPA's kimi catalog channel is added and listed while a Kimi login is on.

Not impersonating

Requests carry User-Agent: sub2api and X-Msh-Platform: sub2api, with a random device id per login. That matches how CPA identifies itself to Kimi (as CLIProxyAPI). Nothing poses as Kimi's own CLI. As with the Claude and Codex logins, the OAuth client id is Kimi Code's.

Security and safety check

• The API host comes only from the domain (kimi.com or kimi.ai). A file's base_url is ignored, so an uploaded auth file can't send its token anywhere else. Auth hosts are fixed too.
• The device page URL Kimi returns must be https://.
• Polling is rate-limited per session, and sessions expire after 15 minutes, the same as Kimi's device code. The callback route refuses Kimi sessions.
• The gateway key never goes upstream: authorization is replaced with the login token, and x-api-key isn't forwarded.
• Endpoints are the existing management ones, behind the sign-in cookie and management key.

Tests

vitest: 188 passed, including the new kimi.test.ts (device flow, slow polling, kimi.ai, refusal, refresh, base_url ignored, model mapping) and Kimi routing tests. tsc and eslint are clean. Not yet tried against Kimi's live servers.

---

Generated by Claude Code