# 06 — z.ai, MiniMax, and Kimi usage APIs (https://jackin.tailrocks.com/research/product/desktop/usage-provider-apis/06-zai-minimax-kimi-apis/)



## Summary [#summary]

Z.AI, MiniMax, and Kimi each expose subscription limits, but their authentication and reset semantics require provider-specific adapters.

## Question and scope [#question-and-scope]

For each of z.ai (GLM coding plan), MiniMax (coding/agent plan), and Kimi (Moonshot AI, Kimi for Coding): (1) which official endpoint(s) expose subscription/coding-plan usage quotas — windows (5-hour/daily/weekly), percent or counts remaining, reset times; (2) what auth is required and where credentials live (location/type only); (3) is a plan label available via API; (4) which display elements have no direct API source (deficit, run-out projections).

This chapter informs jackin-desktop.

## Method [#method]

**Verification cutoff:** 2026-07-24
**Method:** web + codebase cross-reference. Verified live 2026-07-24. Clean-room constraint honored: CodexBar and OpenUsage source/docs excluded (their repo pages surfaced in several searches and were discarded; no endpoint lifted from them). No embedded instructions were observed in any fetched external content.

## Findings [#findings]

### z.ai [#zai]

**Q1 — Endpoints.**

* Quota endpoint (real, but officially undocumented): `GET https://api.z.ai/api/monitor/usage/quota/limit` (global) and `https://open.bigmodel.cn/api/monitor/usage/quota/limit` (CN; also seen as `bigmodel.cn`). It appears in no official z.ai doc page checked (devpack FAQ, ZCode configuration); it is corroborated by ≥4 independent third-party clients: [opencode-glm-quota](https://github.com/guyinwonder168/opencode-glm-quota/), [opencode-mystatus](https://github.com/vbgate/opencode-mystatus) (+ its [docs mirror](https://lzw.me/docs/opencodedocs/vbgate/opencode-mystatus/platforms/zhipu-usage/)), [pi-zai-usage](https://github.com/harms-haus/pi-zai-usage), and a [cc-switch issue](https://github.com/farion1231/cc-switch/issues/1588) quoting the response. Confidence: HIGH that the endpoint exists and serves quota; MED on any individual response detail (no primary doc). jackin❯ already calls exactly this path: `crates/jackin-usage/src/usage/zai.rs:257-266` (fetch) and `zai.rs:276-290` (URL resolution, env overrides `ZAI_QUOTA_URL`/`Z_AI_QUOTA_URL`, `ZAI_API_HOST`/`Z_AI_API_HOST`, default host `https://api.z.ai`).
* Response shape (third-party observed, MED): `{code, msg, success, data:{limits:[…], level}}`; each `limits[]` entry: `type` (`"TOKENS_LIMIT"` or `"TIME_LIMIT"`), `unit`, `number`, `usage` (total), `currentValue` (used), `remaining`, `percentage`, `nextResetTime` (epoch ms). Source: [cc-switch issue #1588](https://github.com/farion1231/cc-switch/issues/1588). jackin❯ parser matches field-for-field: `zai.rs:104-117` (`ZaiLimitRaw`), percent math `zai.rs:174-195`, window decode from `unit`/`number` `zai.rs:197-209`, reset from `nextResetTime` ms→s `zai.rs:215`.
* Windows (official, HIGH): [docs.z.ai/devpack/faq](https://docs.z.ai/devpack/faq) documents 5-hour prompt quotas (Lite \~80 / Pro \~400 / Max \~1600 prompts per 5 h), a weekly quota ("refreshed and reset on a 7-day cycle" anchored to order time), and monthly MCP tool counts (Web Search/Reader: 100/1,000/4,000 per month by tier). The quota endpoint's three buckets map onto these: two `TOKENS_LIMIT` entries (5-hour + weekly) and one `TIME_LIMIT` entry (MCP monthly) — window labels per [opencode-glm-quota](https://github.com/guyinwonder168/opencode-glm-quota/) ("5h Token", "Weekly", "MCP (1 Month)"), MED. jackin❯ renders the same triple: `zai.rs:128-160`.
* Two sibling endpoints exist per [opencode-glm-quota](https://github.com/guyinwonder168/opencode-glm-quota/) (MED), but they are outside jackin❯ limits-only scope and are not called (<RepoFile path="crates/jackin-usage/CLAUDE.md" />).
* Quota is also shown in the provider web console (Usage Statistics); official docs point users there rather than to an API ([docs.z.ai/devpack/faq](https://docs.z.ai/devpack/faq), [zcode.z.ai configuration](https://zcode.z.ai/en/docs/configuration)). HIGH.

**Q2 — Auth.** API key (console-issued), sent in the `Authorization` header. Two independent third-party sources state the header carries the raw key with **no `Bearer` prefix**: [opencode-glm-quota](https://github.com/guyinwonder168/opencode-glm-quota/) ("The plugin does NOT use 'Bearer' prefix… The token is passed directly") and the [cc-switch issue script](https://github.com/farion1231/cc-switch/issues/1588) (`"Authorization": "{{apiKey}}"`). MED. jackin❯ sends Bearer via `get_json_bearer` (`zai.rs:259`) — see Contradictions. Storage: environment variable only (jackin❯ surfaces `"API token · env {key_name}"`, `zai.rs:58-62`); ecosystem tools read it from their own config stores (e.g. opencode `auth.json` under `~/.local/share/opencode/`, type: API key — location/type only, per [opencode-mystatus](https://github.com/vbgate/opencode-mystatus)). No OAuth flow observed for the coding plan.

**Q3 — Plan label.** The quota response carries `data.level` (observed value `"pro"`) per [cc-switch issue #1588](https://github.com/farion1231/cc-switch/issues/1588) — MED, single observation. Official plan tier names Lite/Pro/Max are documented ([docs.z.ai/devpack/faq](https://docs.z.ai/devpack/faq), HIGH) but no official plan-label API is documented. Cross-reference gap: jackin❯ deserializer aliases `planName`/`plan`/`plan_type`/`packageName` (`zai.rs:95-101`) and does **not** map `level`, so the one plan field actually observed in the wild would be dropped.

**Q4 — No direct API source.** Deficit/run-out projection, burn rate/pace, and per-prompt counts for the 5-hour window (official framing is "prompts", the API reports token-ish counts/percentages) have no API source; any projection must be computed client-side from `percentage` + `nextResetTime`. Account identity (email/username) is not in the quota response as observed.

### MiniMax [#minimax]

**Q1 — Endpoints.**

* **Officially documented** (the only provider of the three with a primary-source quota API): `curl 'https://www.minimax.io/v1/token_plan/remains' --header 'Authorization: Bearer <API Key>'` under FAQ "How to check Token Plan usage?" — [platform.minimax.io/docs/token-plan/faq](https://platform.minimax.io/docs/token-plan/faq). HIGH.
* Windows (official, HIGH): "Included Token Plan quota: Controlled by a 5-hour rolling window and a weekly window"; "Unused included Token Plan quota does not carry over to the next billing cycle" ([token-plan FAQ](https://platform.minimax.io/docs/token-plan/faq), [token-plan intro](https://platform.minimax.io/docs/token-plan/intro)).
* Response shape (MED — field names quoted by users in MiniMax's own repo tracker, no staff confirmation): `model_remains[]` with `model_name` (e.g. `"general"`), `current_interval_total_count`, `current_interval_usage_count`, `current_interval_remaining_percent`, `current_weekly_total_count`, `current_weekly_usage_count`, `current_weekly_remaining_percent`, plus account-level `remains_time`; `start_time`/`end_time` bound the windows. Sources: [MiniMax-M2.7 issue #48](https://github.com/MiniMax-AI/MiniMax-M2.7/issues/48), [issue #47](https://github.com/MiniMax-AI/MiniMax-M2.7/issues/47), [OpenClaw MiniMax provider docs](https://docs.openclaw.ai/providers/minimax). jackin❯ parser matches: `crates/jackin-usage/src/usage/minimax.rs:116-144` (`MiniMaxModelRemain` incl. `end_time`, `remains_time`, `weekly_end_time`, per-window `status`), error envelope `base_resp.status_code/status_msg` `minimax.rs:85-91`.
* Hosts/paths: jackin❯ fans out over `api.minimax.io` and `api.minimaxi.com` × `/v1/token_plan/remains` and legacy `/v1/api/openplatform/coding_plan/remains` (`minimax.rs:384-396`). The official doc uses host `www.minimax.io`; OpenClaw's docs use the `api.*` hosts (MED). The legacy `coding_plan/remains` path on `www.minimaxi.com` was reported to reject API keys with `{"base_resp":{"status_code":1004,"status_msg":"cookie is missing, log in again"}}` — [MiniMax-M2 issue #88](https://github.com/MiniMax-AI/MiniMax-M2/issues/88), MED, no staff reply. jackin❯ fallback ordering (token\_plan first) is consistent with that report.
* Reset time: `end_time` (epoch, ms or s) or countdown `remains_time`; jackin❯ prefers `end_time` and derives from `remains_time` only as fallback (`minimax.rs:410-417`). Caveat: [issue #47](https://github.com/MiniMax-AI/MiniMax-M2.7/issues/47) reports `remains_time` draining passively — countdown-derived resets are suspect (MED).
* Plan tiers (official, HIGH): Plus $20 / Max $50 / Ultra $120 per month — [token-plan intro](https://platform.minimax.io/docs/token-plan/intro), tier names confirmed in [FAQ](https://platform.minimax.io/docs/token-plan/faq).

**Q2 — Auth.** Coding-plan API key, `Authorization: Bearer <key>` (official FAQ, HIGH). Storage: environment variable; ecosystem env names `MINIMAX_CODE_PLAN_KEY`, `MINIMAX_CODING_API_KEY`, `MINIMAX_OAUTH_TOKEN`, `MINIMAX_API_KEY` ([OpenClaw docs](https://docs.openclaw.ai/providers/minimax), MED). jackin❯ reads env `MINIMAX_API_KEY` / prompts for `MINIMAX_CODING_API_KEY` (`minimax.rs:49-56`) and adds a self-identifying `MM-API-Source: jackin-capsule` header (`minimax.rs:349`) — no external evidence this header is required. No credential file observed; key is console-issued.

**Q3 — Plan label.** Not documented. jackin❯ speculatively parses `current_subscribe_title` / `plan_name` / `combo_title` / `current_plan_title` / `current_combo_card.title` (`minimax.rs:97-114`, `minimax.rs:201-217`); **no external source corroborates any of these field names** — open unknown. Official tier names exist only as docs prose.

**Q4 — No direct API source.** Plan label (unverified), burn rate/pace, run-out projection, and window duration labels (must be derived from `start_time`/`end_time`); per-model quotas other than `general` reportedly return zeros in some plan states ([issue #48](https://github.com/MiniMax-AI/MiniMax-M2.7/issues/48), MED).

### Kimi [#kimi]

**Q1 — Endpoints.** Two distinct usage surfaces exist; neither is in official docs.

* **Coding-plan API-key surface**: `GET https://api.kimi.com/coding/v1/usages` (fallback `…/usage`). Not documented on [kimi.com/code docs](https://www.kimi.com/code/docs/en/) (which document only the inference base URLs `https://api.kimi.com/coding/v1` OpenAI-compatible and `https://api.kimi.com/coding/` Anthropic-compatible) nor on platform.kimi.ai. Corroborated by the third-party tracker [Golden0Voyager/kimi-code-usage](https://github.com/Golden0Voyager/kimi-code-usage): source builds `base_url + "/usages"` with `Authorization: Bearer {api_key}` and — notably — spoofs `User-Agent: KimiCLI/1.6`; parsed fields include `data`/`usage`/`limits`, `limit`, `used`, `remaining`, `resetTime`/`reset_at`/`reset_time`, and window objects `window.duration`/`timeUnit` (HIGH for that library's behavior; MED that the endpoint is stable/official). jackin❯ calls the same URL (`crates/jackin-usage/src/usage/kimi.rs:258-267`) but with `User-Agent: jackin-capsule/usage` (`kimi.rs:265`).
* **Web billing gateway (OAuth session)**: `POST https://www.kimi.com/apiv2/kimi.gateway.billing.v1.BillingService/GetUsages` with body `{"scope":["FEATURE_CODING"]}`, plus fallbacks `https://www.kimi.com/api/user/usage` and `https://www.kimi.com/api/usages`; `Authorization: Bearer <access_token>` plus web headers (`connect-protocol-version: 1`, `x-msh-platform: web`, etc.). Response fields: `usages[]` with `scope` (`FEATURE_CODING`), `detail{limit,used,remaining,resetTime}`, `limits[]` with `window{duration,timeUnit}`, and `membership`/`level`/`name`. Source: [blindlight86/kimi-code-usage-skill](https://github.com/blindlight86/kimi-code-usage-skill) scripts (`scripts/get_kimi_usage.sh`). MED (working third-party scripts; internal web API, no doc). jackin❯ `KimiUsageResponse` parses exactly this shape — `usages[].scope == "FEATURE_CODING"`, `detail`, `limits[].window.duration/timeUnit` (`kimi.rs:88-160`) — even though it sends the request to the `api.kimi.com/coding/v1/usages` URL, implying both surfaces return the same schema (unconfirmed; see Open unknowns).
* Windows: official docs state only the 5-hour request window ("approximately 300–1,200 requests per 5-hour window", 30 concurrent) — [kimi.com/code docs](https://www.kimi.com/code/docs/en/), HIGH. A weekly quota window is shown by multiple third-party trackers ([kimi-code-usage README status bar "Wee:%… 5Ho:%"](https://github.com/Golden0Voyager/kimi-code-usage), MED) but is not stated in official docs. Reset time arrives as an ISO string `resetTime` (jackin❯ parses it at `kimi.rs:110-112`, `kimi.rs:237`); rate-limit window duration/unit arrive structured (`kimi.rs:120-125`, `kimi.rs:199-218`).

**Q2 — Auth.** Two credential types (locations/types only):

* API key `sk-kimi-…` created in the Kimi Code Console, held in env (`KIMI_API_KEY` in third-party tooling — [kimi-code-usage](https://github.com/Golden0Voyager/kimi-code-usage); jackin❯ uses env `KIMI_CODE_API_KEY`, `kimi.rs:63`).
* OAuth-style short-lived `access_token` + `refresh_token` + `expires_at` JSON written by Kimi Code CLI login to `~/.kimi/credentials/kimi-code.json` (mode 0600); some tools also reference `~/.kimi-code/credentials/kimi-code.json`. Sources: [blindlight86/kimi-code-usage-skill](https://github.com/blindlight86/kimi-code-usage-skill) (states that credentials are written only to `~/.kimi/credentials/kimi-code.json`), [pi-provider-kimi-code](https://github.com/Leechael/pi-provider-kimi-code), [pi-kimi-coder](https://github.com/picassio/pi-kimi-coder) (MED each, converging). Official [kimi-cli docs](https://moonshotai.github.io/kimi-cli/en/configuration/providers.html) document config at `~/.kimi/config.toml` and a `/login` wizard but do not document the credentials file (HIGH for config.toml only). jackin❯ probes both credential paths with expiry check (`kimi.rs:269-297`).

**Q3 — Plan label.** Membership tiers Moderato / Allegretto are official ([kimi.com/code docs](https://www.kimi.com/code/docs/en/), HIGH). Via API, a plan label (`membership`/`level`/`name`) is only evidenced on the web `BillingService/GetUsages` surface (MED); no evidence the API-key `GET /coding/v1/usages` returns one. jackin❯ currently sets `plan_label: None` for Kimi (`kimi.rs:60`) — consistent with the evidence.

**Q4 — No direct API source.** Pace/run-out projection (jackin❯ computes `quota_pace_label` locally, `kimi.rs:238-239`); plan label on the API-key surface; account identity/username. Client gating is a risk, not a display element: the coding inference endpoint rejects non-whitelisted agents ("Kimi For Coding is currently only available for Coding Agents such as Kimi CLI, Claude Code, Roo Code, Kilo Code, etc." — [nanobot issue #354](https://github.com/HKUDS/nanobot/issues/354), MED), and the one third-party tracker with visible source spoofs `KimiCLI/1.6` UA — whether `/usages` enforces the whitelist/UA is unknown.

### Dead ends and contradictions [#dead-ends-and-contradictions]

* **CodexBar docs excluded (clean-room).** `github.com/steipete/CodexBar/docs/zai.md` and `docs/kimi.md` were top hits for four separate queries; discarded unread. All endpoints above are sourced from official docs, vendor repo trackers, or non-banned third-party repos, and cross-checked against jackin❯ existing probes.
* **z.ai Authorization header: raw key vs Bearer.** Two independent third-party clients send the raw key with no `Bearer` prefix; jackin❯ sends `Bearer` (`zai.rs:259`) and presumably works. Both may be accepted server-side; unproven either way. MED contradiction, resolvable only with a live key.
* **z.ai quota API is officially undocumented.** Checked [docs.z.ai/devpack/faq](https://docs.z.ai/devpack/faq), [devpack overview](https://docs.z.ai/devpack/overview), and [ZCode configuration](https://zcode.z.ai/en/docs/configuration): quota semantics yes, endpoint no. Ruled out: any official OpenAPI/reference page for `/api/monitor/usage/quota/limit`.
* **MiniMax host mismatch.** Official FAQ curl uses `www.minimax.io`; jackin❯ and OpenClaw use `api.minimax.io`/`api.minimaxi.com` (`minimax.rs:388-394`). Whether the `api.*` hosts serve `/v1/token_plan/remains` identically is unverified here.
* **MiniMax legacy path auth.** Docs said Bearer; [MiniMax-M2 issue #88](https://github.com/MiniMax-AI/MiniMax-M2/issues/88) showed `coding_plan/remains` demanding a browser cookie session (status 1004). The newer `token_plan/remains` is the documented key-auth path; the legacy path in jackin❯ fallback list may only ever fail for key auth.
* **MiniMax `remains_time` semantics disputed** ([issue #47](https://github.com/MiniMax-AI/MiniMax-M2.7/issues/47) reports passive drain) — contradicts "consumption-only" expectation; supports jackin❯ `end_time`-first reset derivation (`minimax.rs:410-417`).
* **Search-summary noise dropped:** one aggregated search result claimed `Z_AI_QUOTA_URL=https://open.bigmodel.cn/api/coding/paas/v4` as a "quota URL override" — that path is the chat-completions endpoint, not the quota endpoint; dropped as conflation. Similarly, unofficial blog domains (aipricing.guru, minimax-ai.chat, kimi-ai.chat, lorphic.com, nxcode.io) were treated as leads only and nothing was sourced from them.
* **Kimi official docs dead end:** neither [kimi.com/code docs](https://www.kimi.com/code/docs/en/) nor [kimi-cli docs](https://moonshotai.github.io/kimi-cli/en/configuration/providers.html) document any usage-query endpoint or command. platform.moonshot.ai now redirects into the platform.kimi.ai / kimi.com doc set; no moonshot.ai-hosted usage API doc found.

## Implications for jackin❯ [#implications-for-jackin]

Keep provider-specific adapters and confidence labels because these quota surfaces differ in authentication, reset semantics, and documentation quality.

## Limitations and unknowns [#limitations-and-unknowns]

* **z.ai:** Does the quota endpoint accept `Bearer`-prefixed auth (jackin❯ current form, `zai.rs:259`)? Enumeration of `data.level` values (only `"pro"` observed) and whether `level` is the sole plan field — jackin❯ aliases (`zai.rs:95-101`) match nothing observed. A LOW-confidence lead says the API shifted toward percentage-only (counts zeroed) around Feb 2026 — unverified. All three need an operator-authenticated probe (curl with a live coding-plan key; no browser needed).
* **z.ai:** exact team-account behavior (`usageScope: team` seen in one search summary only — LOW, dropped from findings).
* **MiniMax:** Do any plan-title fields (`current_subscribe_title` etc., `minimax.rs:97-114`) actually appear in the `token_plan/remains` response? Needs an operator-authenticated response capture (API key curl suffices).
* **MiniMax:** Whether `api.minimax.io`/`api.minimaxi.com` serve `token_plan/remains` identically to documented `www.minimax.io`; full response envelope (`data` wrapper vs root `model_remains` — jackin❯ accepts both, `minimax.rs:219-226`).
* **Kimi:** Exact JSON schema of `GET https://api.kimi.com/coding/v1/usages` — including whether it returns `usages[]`/`FEATURE_CODING` (the shape jackin❯ parses), whether it includes a membership/plan field, and whether it is User-Agent/client-whitelist gated (third-party tool spoofs `KimiCLI/1.6`; jackin❯ sends `jackin-capsule/usage`, `kimi.rs:265`). Needs an operator key; if the endpoint is UA-gated, needs header experimentation.
* **Kimi:** Whether the OAuth `access_token` from `~/.kimi/credentials/kimi-code.json` is accepted by `api.kimi.com/coding/v1/usages` (jackin❯ assumes yes, `kimi.rs:269-283`) or only by the `www.kimi.com/apiv2` billing gateway. The gateway's stability and required `x-msh-*` headers would need an operator-authenticated browser session to inspect network traffic.
* **Kimi:** Official existence/size of the weekly window (docs state only the 5-hour window; trackers show weekly). Needs authenticated response capture or official doc update.

## Sources [#sources]

* [Z.AI quota client evidence](https://github.com/guyinwonder168/opencode-glm-quota/)
* <RepoFile path="crates/jackin-usage/src/usage/zai.rs" /> — current Z.AI probe and normalized quota mapping.

## Related work [#related-work]

* [Provider API coverage](/research/product/desktop/usage-provider-apis/)
* [Provider provenance and unresolved semantics](/research/product/desktop/usage-provider-apis/10-provenance-and-misc/)