OPENROUTER_API_KEY, your choice of models, your own per-user metering and limits — the hermes-byo-model kit is the supported path. It’s a complete forkable app in which every Hermes turn runs on your OpenRouter account, through a proxy hosted in your own app.
agent37-platform/hermes-byo-model
The full app, ready to fork: auth, workspaces, chat, files, a per-agent model budget with real spend, and the money proxy that enforces it. Next.js and Supabase, deploys to Vercel. MIT.
Managed model or your own?
Compute is billed the same either way — an instance is a computer, whoever’s model it calls.
How it works
- Your key stays home. The instance holds only a revocable per-agent token; the OpenRouter key lives in your app’s environment and never reaches an instance or the browser. Rotating a token is a button in the kit’s Settings tab.
- Per-agent budgets, enforced before the call. Each agent carries a monthly cap. The proxy checks month-to-date spend first and refuses with
402when it’s reached — the agent surfaces that as a plain message in chat rather than failing silently. - Real cost, not estimates. The proxy asks OpenRouter to include usage accounting and records the dollars it reports, per agent, per model, per day. That table is what you’d invoice your own users from.
- The clean base image. The kit registers a workspace template on Agent37’s
hermes-baseimage, which boots with no model provider at all — so the config the app writes is the only one the agent has. The stockagent37-hermestemplate re-wires the managed model at every boot, which would leave a second, Agent37-billed model sitting in the picker.
Nothing here is OpenRouter-specific on the Agent37 side. Hermes needs an OpenAI-compatible endpoint serving
GET /v1/models and POST /v1/chat/completions — point the kit’s proxy at any provider, or at your own inference, by changing one constant. OpenRouter is the default because one key reaches every major model.Get started
1
Get your keys
Three secrets, each behind a login: an
sk_live_ API key from a funded workspace (see Billing), an OPENROUTER_API_KEY from openrouter.ai/settings/keys with credit on it, and a Supabase access token — the kit provisions a free Supabase project for you.2
Clone it
3
Run setup
The fastest path is agent-driven: open the folder in Claude Code or Codex and paste the setup prompt from the README. It asks for your three keys, provisions Supabase, and registers the agent template in your workspace.By hand:
npm install, then npm run setup twice — the first run creates .env.local and exits asking for the keys; paste them in and run it again — then npm run templates:publish.4
Run it
http://localhost:3000, sign up, and create an agent. Agents run on Agent37 Cloud and call your app for every turn, so the app needs a public URL: npm run dev opens a free cloudflared quick tunnel automatically (needs the cloudflared binary — brew install cloudflared — but no Cloudflare account), and in production it’s just your deployed URL. Creating an agent without one is refused, rather than producing an agent with no way to think.What you get
The kit is the Agent37 Starter Kit with the model layer swapped: the same multi-tenant dashboard — email sign-in, workspaces, instance management, native Chat and Files tabs — plus a per-agent model budget, live spend on your OpenRouter account, and a token you can rotate. The chat model picker lists every model your key can reach; a one-line allow-list insrc/config/models.ts narrows that to the models you approve, enforced in the proxy rather than trusted in the UI. Fork it, rebrand it (src/config/branding.ts), and ship it.
Happy with the managed model and just want the app? Use the Starter Kit — same experience on Agent37’s built-in credentials, one key fewer. Want your own integrations instead of your own model? That’s Use your own Composio.