1# PolyLLM23**One interface. Every model. Bring your own keys.** — https://www.polyllm.io45PolyLLM is a universal control center for AI models: connect your own OpenAI, Anthropic, Google Gemini, xAI, Mistral, DeepSeek, Kimi (Moonshot), OpenRouter and Cerebras API keys,6discover the models your keys can reach, configure each one with only the parameters it supports, chat with real7token-by-token streaming, compare up to four models side by side in the Arena, and track tokens, latency and estimated8cost. Keys are encrypted at rest (AES-256-GCM, HKDF-derived data key, AAD-bound to the user) and only decrypted on the9server immediately before a provider request.1011## Stack12Next.js 16 (App Router, Route Handlers with SSE streaming) · React 19 · TypeScript · Tailwind v4 · PostgreSQL 17 + Drizzle ·13Better Auth 1.7 (Argon2id, email verification, sessions, reset, change email, delete account) · Resend · Zod ·14official provider SDKs (`openai`, `@anthropic-ai/sdk`, `@google/genai`); xAI, Mistral, DeepSeek, Kimi, OpenRouter and Cerebras through the OpenAI SDK pointed at their endpoints with per-provider body translation (`providers/shared/openai-compat`).1516## Layout17```18src/app routes: (marketing) landing/legal · (auth) login/signup/verify/reset · app/* workspace · admin/* · share/[id] · api/*19src/lib/ai/core provider-neutral contract: PolyModel, UnifiedChatRequest, UnifiedStreamEvent, errors, retry, pricing, normalization20src/lib/ai/providers adapters (openai, anthropic, gemini, xai, mistral, deepseek, kimi, openrouter, cerebras) + catalogs — provider quirks live ONLY here21src/lib/ai/registry model registry: live listing → catalog merge → Postgres; scheduled + manual sync22src/lib/chat turn orchestration (edit/regenerate/continue/branch), built-in tools loop, SSE23src/lib/providers encrypted key storage & validation24src/components ui kit · app shell · chat · arena · settings · marketing25docs/ provider-research (per provider, dated), provider-test-matrix (generated), deployment-cluster, final-audit, UI brief26scripts/ sync-models, provider-matrix (real-API tests)27e2e/, tests/ Playwright workflows, vitest unit tests28```2930## Development31```bash32cp .env.example .env # fill AUTH_SECRET, API_KEY_ENCRYPTION_SECRET, RESEND_API_KEY, owner provider keys (optional)33createdb polyllm && pnpm install && pnpm db:migrate34pnpm models:sync # populate the registry with the owner keys35pnpm dev # http://localhost:300036pnpm typecheck && pnpm lint && pnpm test37pnpm providers:matrix # real-API capability matrix → docs/provider-test-matrix.md38EMAIL_DRY_RUN=1 EMAIL_DRY_RUN_PRINT=1 pnpm dev && pnpm test:e2e # full browser workflow (links read from the dev log)39```4041## Deployment42Runs on the private MacLustr cluster behind ngrok — see `docs/deployment-cluster.md`.4344## Security notes45No provider key ever reaches the browser, logs or analytics (structured logger redacts key-shaped strings and sensitive46field names). CSP, HSTS, HttpOnly/SameSite cookies, rate limits on auth and provider endpoints, per-user audit log.47