OmniRoute: the 1.62B free-token headline recomputes to the digit, and 20 of 20 channels wanted a key first

OmniRoute is a self-hosted gateway that puts one endpoint in front of 1,200+ models. It is also the fastest-rising project in our corpus this week: +2,277 stars in 7 days, 73,674 total, TypeScript. Its headline is a number a reader can check: ~1.62B free tokens per month, from 489 free-tier entries across 35 recurring pool keys.

We took the catalog they ship (release/v3.8.52, commit 8ad6b1c). We ran their own aggregator, computeFreeModelTotals() in open-sse/config/freeModelCatalog.ts, unmodified. Then we POSTed to the API endpoints in their provider registry with no credential at all.

1.Result

2.The dedup is the whole story

Summing the same 287 steady rows without their pool rule gives 13,253,075,000 tokens/month, 8.16x the headline. The pool rule removes 11,629,850,000 of that, 87.75%. 489 entries look like 489 quotas, but only 35 of them are accounts. A shared pool is counted once at its largest member.

The honest number is also a concentrated one. Mistral alone is 1,000,000,000 of the 1,623,225,000 (61.61%). The top four pools (Mistral, Nara, LLM7, xKiro) are 1,510,000,000 (93.02%). The other 13 pools that carry a budget split 113,225,000 between them.

3.The 20 providers behind the headline

The sample was fixed before the first request: every provider with a positive documented monthly budget (19), plus the largest keyless provider (Pollinations). Each got one POST to the base URL in OmniRoute’s own registry with no Authorization header.

Their model is one account per provider, not keyless: the headline is what you hold after creating 18 accounts and pasting 18 keys. That is not a defect in the arithmetic. It is the gap between “tokens per month” and “tokens you can spend right now”, and the README does not close it.

4.What “keyless” means here

The catalog makes a stricter claim worth testing: 69 entries across 13 providers are marked freeType: “keyless”. The code that routes them even documents the failure. blackbox, friendliai, iflytek and sparkdesk are “catalogued keyless yet answer 401 without a credential”. We probed all 13.

The sharpest case is Pollinations. Its entry still says keyless and still carries the comment “verified live 2026-07-20: HTTP 200 with real choices”. But it routes to gen.pollinations.ai/v1, which answered our keyless POST with 401 “A valid API key is required”. The legacy host the code routes away from (text.pollinations.ai/openai) answered “Pong! How can I help you today?”.

One of our own readings was wrong and is worth recording. Five providers first answered HTTP 403 “error code: 1010”, which is Cloudflare’s bot check firing at python-urllib’s User-Agent, not at the provider. Re-probed with a browser User-Agent, four of them became plain 401s. A scripted probe that does not set a User-Agent reports its own fingerprint as a provider failure.

Decision

Worth it if you will make accounts

1.6232B recomputes exactly from their catalog, the counting is the honest part of this project.

• Pool dedup strips 87.75% of the 13,253,075,000 naive sum
• 18 accounts have to exist before the headline is reachable

Read 1.62B as one number

18 of the 20 providers behind it answered our keyless request with a credential wall.

• 61.61% of the total sits on a single vendor you must sign up to
• Mistral alone is 1,000,000,000 of the 1,623,225,000

Keyless is the aged-out layer

Only 2 of 13 keyless entries answered today.

• Pollinations is 401 on the host their code routes to
• The legacy host the code routes away from answered with a real completion

Not a no-signup setup

Without creating accounts this gateway gave us 2 working keyless channels.

• One of them sits on a host their own comment calls retired

What we did not measure

• No account was created and no key of ours was used: whether the free tier pays out after signup is untested here, and only the anonymous path was measured.
• Token figures are their published numbers. We verified the catalog and the arithmetic, not the quotas: 13 of the 35 pools were checked for reachability only.
• “359 providers (150+ free)” is not reproducible from the repo: the README says 358 providers four times, the GitHub description says 359, and the shipped registry holds 256 provider directories.
• Browser-session providers (agy, duckduckgo-web, muse-spark-web, huggingchat) run through executors this probe does not implement, so their entries are reported, not judged.
• One request per provider per arm, max_tokens=1: a cold or rate-limited channel can answer differently tomorrow, and 429 from OVHcloud is a quota signal, not a verdict.

Raw rows: docs/analysis/2026-10-07-omniroute-free-token-audit.jsonl, 55 rows (environment, claim, repo, catalog recompute, pool table, 33 probes, follow-ups that overturned a first reading, our own failures, limits). This article is our measurement of their claim, not a score for a tool.