TPX v0.3 · an OAuth 2.0 profile + reference provider · proof of concept

Bring your own tokens to any LLM app.

tokenpony is the home of TPX, an OAuth 2.0 profile where apps ship without API keys and you pay a token provider you choose, hosted or running on your own laptop. tokenpony is also the reference provider implementing it end to end. The app gets a metered budget. You keep the reins. (For autonomous agents there is TPX-A, an experimental extension described below.)

Try Pony Chat Read the spec

# any TPX provider: plain OAuth discovery
$ curl https://api.tokenpony.dev\
/.well-known/oauth-protected-resource

{
  "resource": "https://api.tokenpony.dev",
  "authorization_servers": [
    "https://api.tokenpony.dev"
  ]
}
# AS metadata advertises the TPX grant type:
#   authorization_details_types_supported:
#     ["llm-inference"]

Apps shouldn’t have to sell you tokens.

Today, every app buys tokens

Every LLM app fronts its own inference bill, so every app fights abuse, throttles free tiers, and gates features behind yet another subscription. A thousand apps, a thousand billing relationships.

With TPX, you bring a budget

You hold one balance with a provider you trust. An app asks for a scoped grant (say, 100k tokens) and you approve it with a passkey. The app never sees your keys or your card.

The result is an open ecosystem

Developers ship LLM apps the way they ship static sites: no inference bill, no abuse surface, no billing ops. Providers compete on price and models, the way hosts compete on email or DNS.

Prefer plain talk? The campfire version explains all of this with hay.

The route

OAuth taught apps to ask for identity.
TPX teaches them to ask for tokens.

Discover
The app fetches standard OAuth metadata (RFC 9728, then RFC 8414) from whichever provider the user names. A provider speaks TPX if it supports the llm-inference grant type.
Authorize
The app pushes the request (PAR) with PKCE and a typed llm-inference budget, then redirects. The user signs in with a passkey and approves the budget on the consent page.
Grant
The app exchanges the one-time code for a short-lived access token and a rotating refresh token, scoped to that budget, optionally DPoP-bound, revocable any time.
Deliver
The app calls the provider’s OpenAI-compatible API. The provider meters actual usage in dollars against the budget; usage.cost reports every debit. When it’s spent, the app asks again.

For agents · TPX-A experimental

Apps act for a person.
Agents can act for themselves.

The flow above is for apps a person is signed into. Autonomous agents are different: they carry their own cryptographic identity. So tokenpony also speaks TPX-A, our binding of AAuth (Dick Hardt's agent-authorization protocol) and its AAuth-Budget extension. An agent gets a metered, identity-free budget that a person approves at a Person Server they choose. Same dollars, same models, same meter as the rest of tokenpony. TPX-A is experimental: TPX is the focus for now, and this profile will change as the AAuth drafts evolve.

The agent has its own keys

An Ed25519 identity published at a well-known URL, proving possession on every request with HTTP Message Signatures. No shared secret, no pasted API key, no app impersonating the agent.

A person approves a budget

The person grants a budgeted mission at their Person Server, capped in dollars and limited to chosen models. tokenpony issues a token that carries the budget and no identity. AuthGravity is the reference Person Server.

The budget is a cap, not a blank cheque

A mission is a damage cap plus proof of consent, not a payment. Spend draws from a tokenpony account that backs it, up to the cap, revocable any time. A leaked agent token can spend at most what's left.

Standard AAuth: RFC 9421 signatures, RFC 9396 rich authorization, a resource that publishes /.well-known/aauth-resource.json. Agent quickstart in llms.txt; the profile is Appendix B of the spec.

The stable

What this provider serves.

Under the hood, tokenpony runs open-weight models on Cloudflare Workers AI, metered at live per-token rates. That's this provider's implementation choice, not part of TPX: any provider can serve any models. Published weights just mean no app built on TPX is hitched to us.

1Tkimi-k2.7-codeMoonshot AI · code + agents · 262k context
70Bllama-3.3-70bMeta · fast fp8 serving
120Bgpt-oss-120bOpenAI · open-weight reasoning
32Bqwen2.5-coder-32bAlibaba · tuned for code
24Bmistral-small-24bMistral · vision + text
8Bllama-3.1-8bMeta · quick and cheap

Hosted or local

One protocol, from our cloud to your laptop.

A TPX provider is anything with a discovery document, including a process on your own machine. The open-source repo ships two local provider shims; point Pony Chat (or any TPX client) at either one and the whole flow works unchanged: same consent page, same budget, same meter. Local inference is free, so completions report usage.cost: 0 and the budget is a cap that never depletes.

tpx-local · Jan.ai

Fronts any local OpenAI-compatible server, built for Jan.ai. Enable Jan's local API server and every model on your machine becomes a TPX provider on port 1338.

tpx-claude · your Claude login

Backed by your own Claude Code subscription, personal use only. Approving a grant takes a PIN printed to your terminal, and each session is stripped down to plain chat completions.

# serve your laptop as a TPX provider (Jan.ai on :1337)
$ cd apps/tpx-local && bun run start

# make it reachable from hosted Pony Chat
$ cloudflared tunnel --url http://localhost:1338

# then paste the https://*.trycloudflare.com URL into the
# connect box at ponychat.tokenpony.dev and approve a budget

The field

Where TPX is new, and where it isn’t.

Every piece of this exists somewhere. The OpenAI and Anthropic APIs settled what an inference API looks like. OpenRouter proved one API can front many models, and its account-connect flow proved users will fund apps from a shared balance. Vendor sign-in programs bill approved apps to a subscription. And OAuth is fifteen years old. TPX’s claim is narrower: budget-scoped, pseudonymous grants that any provider can issue, behind a discovery document instead of a company.

	OpenAI / Claude API keys	ChatGPT / Claude sign‑in*	OpenRouter OAuth	“Paste your key” apps	TPX
Who pays for inference	The app developer	The user’s subscription	The user’s OpenRouter balance	The user	The user’s provider balance
What the app holds	A raw vendor key	A vendor-issued token for your account	A key scoped to your account	Your raw key	A budget-scoped grant
Per-app spend cap	No, the key spends freely	Subscription rate limits, not a budget	Optional key limit, set after the fact	No, the key spends freely	Yes, a budget you approve up front
User revocation	N/A, the user has nothing	In vendor account settings	Revoke the key at OpenRouter	Rotate the key everywhere	One click, one app
Provider choice	That vendor	That vendor	One aggregator, many models	Whatever the app hardcoded	Any OAuth server supporting `llm-inference`
What the app learns about you	Whatever it collects	Your vendor account identity	A key tied to your account	Your key = your account	Nothing; grants are pseudonymous

* “Sign in with ChatGPT” and Claude’s app sign-in bill usage to your consumer subscription, but only for vendor-approved apps, inside one vendor’s walls.

Genuinely new here

Not the connect-an-account gesture: OpenRouter’s OAuth flow and the vendor sign-in programs got there first. What TPX adds is the shape of the grant and who can issue it. The budget is approved up front on the consent screen as a hard damage cap, the grant carries no identity, and the issuer is anyone with a discovery document rather than one company. Apps hardcode the protocol, not the vendor.

Deliberately borrowed

The API surface is OpenAI’s, on purpose: your SDK already works. The authorization layer IS OAuth, on purpose: TPX is a profile, so standard client libraries work unmodified. And user-funded apps are proven ground: OpenRouter charges connected apps to your balance, and the vendor sign-ins charge approved apps to your subscription. TPX is those ideas with the walls removed.

For developers

Point your existing SDK at the pony.

The metered API is OpenAI-compatible. Register your app with one call, send users to authorize, and never touch an inference bill again.

# register your app (RFC 7591, open registration in the PoC)
$ curl -X POST https://api.tokenpony.dev/register \
    -d '{"client_name":"My App","redirect_uris":["https://myapp.example/callback"],
         "token_endpoint_auth_method":"none"}'

# push the authorization request (PAR + PKCE + a typed budget), then redirect
$ curl -X POST https://api.tokenpony.dev/par \
    -d 'response_type=code&client_id=…&redirect_uri=…&code_challenge=…&code_challenge_method=S256' \
    -d 'authorization_details=[{"type":"llm-inference","budget":0.10}]'

# exchange the code for tokens, then chat on the user’s balance
$ curl https://api.tokenpony.dev/v1/chat/completions \
    -H "Authorization: Bearer tpx_at_…" \
    -d '{"model":"llama-3.3-70b","messages":[{"role":"user","content":"hi"}]}'