Crusoe Cloud vs Vast.ai

Crusoe Cloud

The v1 REST API has a published OpenAPI description, Markdown docs, HMAC-signed keys, reader roles and a 90-day audit log, with on-demand GPU prices public. No idempotency keys or control-plane rate limits were found, spot and B200 prices go through sales, and a storage outage in eu-norway1 lasted about four hours on 29 September 2026.

Vast.ai

API keys can be limited by permission category and by resource ID, the REST API has a public OpenAPI 3.1 file, and the CLI ships weekly with a skill file for coding agents. Machines belong to independent hosts, prices move with the market, rate-limit thresholds are unpublished, and there is no SLA or free tier.

Crusoe Cloud

1. Sign every request. Build the payload from path, sorted query string, verb and X-Crusoe-Timestamp, HMAC-SHA256 it with the base64url-decoded secret, and send Authorization: Bearer 1.0:<access_key_id>:<signature>.
2. Use https://api.cloud.crusoe.ai/v1. Some docs pages and the MCP server still name api.crusoecloud.com and /v1alpha5.
3. Creates, updates and deletes return an operation. Poll the matching operations endpoint for state, and list existing resources by name before retrying a create, because no idempotency key was found.
4. Managed AI uses separate Intelligence API keys and hosts, api.inference.crusoecloud.com for OpenAI-compatible calls and api.intelligence.crusoecloud.com for files and fine-tuning jobs.
5. Delete a VM and its disks to stop charges. A stopped on-demand VM is not billed for compute, but its 128 GB OS disk still bills at $0.08 a GiB-month.

Vast.ai

1. Create a scoped key with vastai create api-key --permissions for the agent. A default key has full account access, billing and key management included
2. Pass --raw on every CLI command for JSON output, and -y on vastai destroy instance, which otherwise waits for a confirmation prompt
3. Register an SSH key with vastai create ssh-key before creating an instance, or the host is unreachable
4. Destroy instances when finished. A stopped instance still bills storage, and a zero balance without a saved card leads to deletion
5. Back off on HTTP 429 yourself when calling REST directly. The CLI retries 429 three times from 0.15 seconds
6. Filter searches with verified=true or the Secure Cloud option for sensitive data, and set a dph_total price cap