After AI tools like AI Agent and Claude Code emerged, and AI transitioned from being a novelty chat toy for ordinary people to becoming a genuinely productive tool, “how to access GPT, Claude, Gemini, and other model APIs at lower costs” has become a daily problem for many developers. Some of you have probably heard about “API relay services” that offer prices far cheaper than the official providers. These services are shrouded in mystery due to their unclear underlying mechanisms and profit models, and some netizens even claim that this industry…Profits that even exceed those of drug trafficking(Of course, that’s an exaggeration.) So how exactly does that industry make money?
What exactly is an API relay/proxy?
Simply put, an API proxy bundles services from OpenAI, Anthropic, Google, DeepSeek, and other model providers into a single unified gateway, similar to services like OpenRouter. Instead of getting an API key directly from the official provider, users purchase credits from the proxy and just switch their API base URL to the one provided by the proxy. For developers, this means almost no code changes—you can call multiple models through the same key.
Such needs definitely exist. Official APIs may encounter issues with payment thresholds, connection stability, model integration, enterprise billing, or multi-model switching (additionally, Chinese users may also need to solve VPN issues on their own). Open-source projects One API It focuses on using the standard OpenAI API format to access multiple large language models, supporting channel management, tenant management, load balancing, model mapping, and other features.
In other words, “model gateways” themselves aren’t the problem. Using them internally to manage multi-vendor APIs, track costs, control permissions, and route models is a perfectly reasonable architecture. The real issue is that many intermediaries sold to general users lack transparency—users have no idea whether they’re connected to official APIs, low-price regional subscriptions, reverse account pools, free quotas, or a model that isn’t even what they think it is.
Where does the cheap come from? Not all of it is from the black market, but transparency is key.
Resellers can lower prices, partly due to cost differences that fall in legal or gray areas. For example, different model providers, different cloud source channels, enterprise contracts, batch processing, and caching mechanisms can naturally create price differences. OpenAI’s official Batch API provides asynchronous batch requests, and the official documentationclearly stateHandle non-urgent tasks that don’t require immediate responses at a lower cost. OpenAI Pricing PageIt also lists cached input and other pricing items, indicating that repeated input content could inherently be cheaper than standard input within the official system.
If a service provider clearly tells you which official channels it uses, how it prices its services, whether it stores data, and whether it performs model routing—plus offers enterprise contracts, security terms, and audit mechanisms—then it’s closer to a legitimate model proxy or AI Gateway.
However, what may be problematic is another model more commonly seen in communities, groups, and low-price platforms: bundling Claude Max, ChatGPT Plus, low-region accounts, free quotas, or reverse-engineering tools into APIs, then splitting them for many users to share. This practice typically violates the model provider’s terms of service and may also result in account suspension, service interruption, data leakage, and billing disputes. Anthropic’sCommercial TermsIt also clearly restricts the unauthorized resale of services and prohibits reverse engineering or copying services and other such activities.
The biggest risk isn’t the low price—it’s that you can’t see what’s happening behind the scenes.
The biggest security issue with API proxies is that they’re not simply forwarding packets for you. They can see the complete plaintext content of requests and responses. Your prompts sent to the model, project source code, database schema, customer data, cloud keys, and business plans would all theoretically pass through the proxy server.
What’s even more concerning is that AI Agent tools are gaining the ability to execute local commands, modify files, control browsers, and deploy services. When a relay no longer just sees requests but can also modify the model’s responses, the risk escalates from “data being seen” to “response content being tampered with.”
In April 2026, an article titled《Your Agent Is MineTheir research treats the LLM API router as a supply chain attack surface. The study notes that third-party API routers sit between users and upstream models, giving them access to JSON payloads in transit. Without vendor-level cryptographic integrity verification, response-side payload injection and confidential data leakage attacks become possible. The research team tested 28 paid routers and 400 free routers, finding that some routers inject malicious code, others touched AWS canary credentials placed by researchers, and there were even cases where research Ethereum private keys were withdrawn.
This is also why developers using Cursor, Claude Code, OpenCode, or any Agent tool capable of executing local commands should not casually enter keys from unverified proxy services. In regular chats, the worst-case scenario is having your content seen. In Agent scenarios, it could involve local files, shell commands, deployment credentials, and cloud resources.
Model swapping and token inflation make it difficult for users to verify on their own
Another common controversy: users pay for a premium model, but the proxy might actually return a cheaper model, shorten the context length, insert hidden instructions, or inflate token usage (which users would experience as the model feeling less intelligent).
These issues are difficult to fully verify from the outside, because most model APIs have inherent randomness—the quality of answers to the same question can vary at different times. Unless the service provider offers transparent upstream request logs, model ID verification, token usage details, and billing reconciliation, regular users can hardly confirm whether they’re actually getting Claude Opus, GPT-4.1, or Gemini Pro, or being routed to a cheaper model.
More realistically, when relay services use open source gateway systems like One API or New API, their backends already come with built-in features for model mapping, channel management, multiplier settings, and tiered pricing. These capabilities function as management tools when used internally within an enterprise, but when deployed in opaque commercial services, they can become a source of hidden price margins that regular users cannot see.
The discussion expanded partly due to the controversial crypto figure known online as “Sun Ge” (Sun Yuchen), who is often mocked for allegedly “cutting leeks” (retail investors). Recently, he promoted B.AI on X, posting that he had switched his AI usage to B.AI, and envisioned the ideal future as a hub that provides access to all models through a single API Key. Another post indexed by search engines referenced concepts like “one API Key = Claude + GPT + Gemini.” Recently, many netizens jokingly said he has shifted from trading cryptocurrencies to operating an API middleman hub, highlighting the substantial profits involved.
我自己的所有AI使用已经全部切换白https://t.co/4Rv5K8ISNI了，本周内写篇雄文谈谈，为什么从各种角度来说，用户都应该使用中转站，无论你是小白，专业用户，而不是去各类AI官方订阅，未来的终极形态是一个API Key对应所有模型的中转站形态！ https://t.co/5JGm1583mW
— 孙宇晨（去过太空版）🧑🚀 (@sunyuchentron) May 3, 2026
How should regular users hedge/protect themselves?
If you’re just occasionally chatting or looking things up and the content isn’t sensitive, the risks of using a proxy service might still be manageable. But if you’re dealing with company code, customer data, business documents, API keys, cloud credentials, cryptocurrency private keys, or any Agent tools that let AI execute local commands, you shouldn’t go through unknown proxy services—at the very least, stick with well-known providers like OpenRouter for more peace of mind.
A more conservative approach: use the official service directly whenever possible; for company projects, use official cloud channels or enterprise-level AI gateways; when third-party services are unavoidable, choose platforms that have a registered company entity, privacy policies, terms of service, security documentation, model sources, and detailed billing information; avoid large prepaid deposits; never input sensitive data; and definitely don’t enter relay station API keys into agent tools that can execute commands.
API proxy services have become popular because there’s genuine demand. They solve issues with cost, connectivity, payments, and multi-model integration. But the cheaper, the more convenient, and the more they claim to “handle all models,” the more you should ask clearly: How exactly do they achieve this price? Where does your data pass through? Are the models actually what they claim? And who is responsible when something goes wrong?
After AI becomes work infrastructure, the cheapest API isn’t necessarily the best value. Because the model costs you save might come at the expense of data security, account stability, and supply chain risks.
Source: KOCPC Chinese