如何通过 API 形式薅 Gemini Vertex 赠金

需要准备的东西

• 非虚拟卡的 Visa。我使用 ZA 会报风控，但汇丰蓝狮子是 ok 的
• 服务器（也可能非必须，用 render 应该也 ok）

领取谷歌赠金

导出 JSON key

bashCopy
# 1. 查看项目 ID
gcloud projects list

# 2. 设置项目 ID。此处的 <PROJECT_ID> 需要更换成上一步显示的 project id，该 id 会以 project 开头
export PROJECT_ID="<PROJECT_ID>"
gcloud config set project $PROJECT_ID

# 3. 启用 Vertex AI API
gcloud services enable aiplatform.googleapis.com --project=$PROJECT_ID

# 4. 创建服务账号
gcloud iam service-accounts create vertex-openrouter \
--display-name="Vertex OpenRouter" \
--project=$PROJECT_ID

# 5. 给服务账号添加 Vertex AI User 权限
gcloud projects add-iam-policy-binding $PROJECT_ID \
--member="serviceAccount:vertex-openrouter@$PROJECT_ID.iam.gserviceaccount.com" \
--role="roles/aiplatform.user"

# 6. 尝试创建 JSON key
gcloud iam service-accounts keys create vertex-key.json \
--iam-account=vertex-openrouter@$PROJECT_ID.iam.gserviceaccount.com \
--project=$PROJECT_ID

使用 HuggingFace + CloudFlare 部署 API

配置 HuggingFace

dockerfileCopy
FROM ghcr.io/berriai/litellm:main-stable
WORKDIR /app
COPY config.yaml /app/config.yaml
CMD ["--config", "/app/config.yaml", "--port", "7860", "--host", "0.0.0.0"]

yamlCopy
model_list:
  - model_name: vertex-ai/*
    litellm_params:
      model: vertex_ai/*
      vertex_project: "os.environ/VERTEX_PROJECT"
      vertex_location: "os.environ/VERTEX_LOCATION"
      vertex_credentials: "os.environ/VERTEX_CREDENTIALS_JSON"

拿到 HF 的身份认证 token

配置 Cloudflare Worker

jsCopy
export default {
  async fetch(request, env) {
    const origin = request.headers.get("origin");
    const authHeader = request.headers.get("Authorization");
    
    // 从绑定的 Cloudflare 环境变量中安全地读取密钥
    const masterKey = env.LITELLM_MASTER_KEY;
    const hfToken = env.HF_TOKEN;

    // 处理浏览器的 OPTIONS 跨域预检请求
    if (request.method === "OPTIONS") {
      return new Response(null, {
        status: 204,
        headers: {
          "Access-Control-Allow-Origin": origin || "*",
          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
          "Access-Control-Allow-Headers": "Content-Type, Authorization",
        }
      });
    }

    // 1. 门禁校验：检查客户端是否带上了你自定义的 LITELLM_MASTER_KEY
    if (!authHeader || authHeader !== `Bearer ${masterKey}`) {
      return new Response(
        JSON.stringify({ error: "Unauthorized: 接口密钥无效或缺失" }),
        { 
          status: 401, 
          headers: { "Content-Type": "application/json" } 
        }
      );
    }

    // 2. 重写请求的目标地址为你的私有 Space 域名
    const targetHost = "你的用户名-你的项目名.hf.space"; 
    
    const url = new URL(request.url);
    url.host = targetHost;

    // 3. 重构请求头：将客户端传来的自定义 Key 擦除，替换为敲开 HF 私有空间所需的 hfToken
    const newHeaders = new Headers(request.headers);
    newHeaders.set("Authorization", `Bearer ${hfToken}`);

    // 重构完整的请求，安全转发给私有 Space
    const modifiedRequest = new Request(url.toString(), {
      method: request.method,
      headers: newHeaders,
      body: request.body,
      redirect: "follow"
    });

    try {
      let response = await fetch(modifiedRequest);

      // 4. 复制响应，并安全注入跨域头，确保客户端网页能正常跨域接收数据流
      const responseHeaders = new Headers(response.headers);
      responseHeaders.set("Access-Control-Allow-Origin", origin || "*");
      responseHeaders.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
      responseHeaders.set("Access-Control-Allow-Headers", "Content-Type, Authorization");

      return new Response(response.body, {
        status: response.status,
        statusText: response.statusText,
        headers: responseHeaders
      });
    } catch (e) {
      return new Response(JSON.stringify({ error: "Gateway Error", details: e.message }), { status: 502 });
    }
  }
};

测试