Skip to main content
Percher is still being built and account creation is paused — get notified when it opens.
Percher

Managed AI inference

Approval-gated, keyless LLM calls hosted in Paris

Ask your agent
Check whether managed AI is available for my Percher app and explain the data flow before changing anything.Read the guide at percher.app/docs/managed-inference
How it works, with exact details

Apps built from the capsule template (PocketBase apps) can call an LLM through Percher without ever receiving a provider key: Percher makes the call to a model hosted in Paris, meters the token cost, and stores no prompt or completion content. Availability is runtime-configured and can be off — the endpoint then fails closed.

When operational, the template exposes:

import { complete, streamComplete } from "./lib/ai";

const answer = await complete("Summarize this note: " + note);
await streamComplete(prompt, (token) => output.append(token), { signal });

Never place a provider key in a capsule, a VITE_* variable, a browser bundle, or public config. The injected AI URL is only a public Percher endpoint.

Check whether managed inference is switched on

The authenticated GET /capabilities response is authoritative: platform.features.managedInference is the availability flag, and managedInferenceStatus explains disabled, misconfigured, provider-unreachable, quota-exhausted, or operational states. When the flag is false, VITE_PERCHER_AI_URL is absent from new builds and the endpoint fails closed with 503 INFERENCE_DISABLED without contacting a provider.

Provider credentials and production-processing approval are separate gates. A credential by itself cannot activate processing, and an operator emergency-off file stops new upstream requests immediately.

Where your users' text goes (the enforced data path)
  1. The browser sends text and its signed-in PocketBase JWT to POST /capsule/<app>/ai. CORS accepts only that app's Percher hostname or verified custom domain.
  2. Percher verifies the JWT against that app's own PocketBase, applies per-app and per-user rate limits, atomically reserves the worst-case cost, and rejects malformed, oversized, multimodal, and non-allowlisted requests.
  3. Percher sends the text over TLS to Scaleway Generative APIs in Paris ( fr-par). Scaleway hosts the model; model creators do not receive prompts.
  4. The completion returns through Percher. Percher stores metered token cost, not prompt or completion content.

Scaleway publishes zero prompt retention and no model training by default. Its documented exception permits retaining request content for up to two weeks to investigate rare harmful requests or unexpected service errors; aggregated anonymized API metadata may be kept for six months. Do not send data your app is not permitted to process.

Rate limits and daily spend caps

30 requests/min per app, 20 per PocketBase user, 100 KB per request, and 2,000 output tokens. Daily caps reset at 00:00 UTC: free €0.05, Starter €0.50, Maker €2, Max €10.

Each request reserves its worst-case cost up front. Reported usage settles the reservation down; failures release it, while an interrupted stream without usage settles to the conservative reserved bound.

Which models you can call

gpt-oss-120b (default), qwen3.6-35b-a3b, and llama-3.3-70b-instruct. Prices are pinned and reviewed; unknown models fail closed.