Preface

When using DeepSeek Harness (DSH) to handle third-party API requests, frequently checking balances or manually switching Keys can disrupt your workflow. This plugin integrates a status display directly at the bottom of the DSH input box to address these pain points.

Plugin Introduction

Plugin Name: mengshang-spec/dsh-third-party-api-balance-wallet

This is a network utility plugin maintained by Mengshang-spec. It targets third-party API sites built with Sub2API and displays account balance, Key validity, and today’s usage in real time in the DSH interface. The plugin version is 0.3.1, and it uses the MIT license.

Core Features

  1. Status Display: Shows the account balance at the bottom of the input box.
  2. Validity Detection: Displays whether the API Key is valid and the current account mode.
  3. Detail on Hover: Hover the mouse to view today’s request count, Token count, original price, and actual amount paid after discount.
  4. Automatic Refresh: Queries immediately after startup, then automatically refreshes once every 30 minutes.
  5. Flexible Configuration: Supports automatic discovery and manual configuration for Sub2API sites.
  6. Secure Storage: The API Key is stored only on the DSH host side. The browser side does not store the full Key and only receives the masked Key.
  7. Address Restriction: The balance URL is forced to use public HTTPS, rejecting local addresses and intranet IPs.

Installation and Enablement

Run the following command in the DSH terminal to install:

dsh plugin --profile web add github:Mengshang-spec/dsh-third-party-api-balance-wallet

After installation or upgrade, restart DSH so that the host and browser-side plugin can reload the configuration.

Typical Usage

Zero-Configuration Automatic Discovery

If DSH has already configured a model provider for the target site, the plugin can automatically find the balance address and Key. The prerequisites are:

  1. The provider in ~/.dsh/settings.yaml includes baseURL and apiKeyEnv.
  2. The refs in ~/.dsh/.credentials.yaml contain the corresponding apiKeyEnv.
  3. The API Key starts with sk-.

The plugin will select a provider that meets the following conditions in order:
* The baseURL is a public HTTPS address.
* It is not an official model API address such as DeepSeek or OpenAI.
* It has the corresponding apiKeyEnv and credentials.

After automatic discovery, the plugin queries {provider.baseURL}/v1/usage.

Manual Configuration

If automatic discovery fails, click the settings button on the right side of the balance panel (gear icon).

  1. API Key: Enter the long-term API Key for the target site (for example, sk-xxxxxxxxxxxxxxxx). Do not enter the JWT token used for web login.
  2. Balance API URL: Enter the usage endpoint of the Sub2API site, usually /v1/usage. For example, https://hgapi.dieqiyun.top/v1/usage.
  3. Save: Click Save. The Key will be stored in <DSH_PROFILE_DIR>/dsh-wallet-switcher/settings.json.

Environment Variables

You can also set environment variables before starting DSH to override the configuration:

DSH_WALLET_USAGE_URL='https://你的站点/v1/usage'
DSH_WALLET_API_KEY='sk-xxxxxxxxxxxxxxxx'
DSH_WALLET_CURRENCY='USD'

The configuration priority from high to low is: saved in the plugin panel > environment variables > automatic discovery > legacy accessToken configuration > default address.

Applicable Scenarios and Notes

  • Applicable Use: Mainly suitable for sites built with Sub2API. For non-Sub2API sites, the endpoint path or response fields may differ and may require manual adjustment.
  • Security Mechanism: The browser side no longer writes the API Key to localStorage. During upgrades, leftover credentials from older versions are automatically cleaned up. Error responses also do not contain the full Key.
  • Address Restriction: To prevent SSRF attacks, the plugin only allows public HTTPS addresses and rejects http://, localhost, 127.0.0.1, and intranet IPs.
  • Troubleshooting: If a query fails, first confirm that the Key belongs to the site corresponding to the current balance endpoint, confirm that the address format is /v1/usage, and check whether rate limits are triggered due to overly frequent queries (the default refresh interval is 30 minutes).

Summary

This plugin integrates balance querying at the bottom of the DSH input box, simplifying the management process for third-party APIs. It supports two modes: zero-configuration automatic discovery and manual configuration. It also emphasizes security by ensuring that Keys are stored only on the host side.