Gemini Developer API vs xAI API (Grok)

Gemini Developer API 50

Model reading. Keys live in a Cloud project. Since 28 May 2026 new keys are authorisation keys bound to a service account and restricted to the Gemini API, keys can be limited by IP or origin, unrestricted standard keys are rejected, and the docs give a leak checklist, per the API key page re-read on 1 November. No permission scopes, so 25 of 30, less 10 because the API reads a token from the URL. The Discovery document (revision 20261101) lists access_token, oauth_token and key as query parameters, and on 1 November a generateContent request with no credential answered 403 'Method doesn't allow unregistered callers' while one with a made-up ?access_token= answered 401 'Request had invalid authentication credentials' (ACCESS_TOKEN_TYPE_UNSUPPORTED), the deduction Google APIs took on 17 October and 1 November and Gemini Embedding and Gemini Live carry (15 of 30). Terms (effective 23 March 2026, re-read 1 November) say free-tier prompts and responses are used to improve Google products and human reviewers may read them, paid tier isn't used (10 of 20). Abuse monitoring on paid services is kept 'a limited period' with no number, grounding data 30 days, and since 26 October new paid projects store Generate Content requests by default unless store=false. No zero-retention route on this API was found (5 of 15). Request logs in AI Studio for billed projects (15). security.txt on google.com valid to 2030-04-01 with a vulnerability reward programme, re-read on 1 November. No certification naming the Developer API found, the reading Gemini Embedding takes (5 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Gemini Developer API 40

No machine payment protocol (0). Per-token prices published without a login, re-read on 1 November (20). Free tier on 3.8 Flash, 3.6 Flash, 3.5 Flash-Lite and 3.1 Flash-Lite, not on gemini-4-argon or 3.1 Pro preview, and the rate-limits page needs only an active project for the free tier and a linked billing account from Tier 1, so the free tier needs no card (20). A Google account and AI Studio are needed for a key (0).

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Gemini Developer API 45

Status page at aistudio.google.com/status (robots.txt allows it), but on 1 November it still returned a script shell titled Google AI Studio with no components or history, so 10 of 20, and 5 of 30 for the incident line with no readable record, as the Gemini Live and Gemini Embedding listings read the same page. Google Cloud's status dashboard covers Vertex AI products, not this endpoint. Per-model RPM and TPM live in AI Studio. The public rate-limits page, re-read on 1 November, publishes tier rules, spend-based limits of $10, $50 and $200 per 10 minutes for Tiers 1 to 3, and batch queue limits (5 of 15). The troubleshooting page, re-read on 1 November, gives exponential backoff with jitter for 429 RESOURCE_EXHAUSTED and 503 UNAVAILABLE, says to retry 429, 408 and 5xx and not 400, 402 or 403, and says the Python SDK retries transient errors up to four times (15). No SLA found for the Developer API (0). The flagship gemini-4-argon went GA on 13 October 2026 and the default 3.8 Flash is GA, and the Interactions API the guides lead with has been Generally Available since June 2026. The listing's example and the SDKs default to the v1beta path, which Google labels beta, but the API versions page, read on 1 November, says the stable v1 path carries the Interactions API, generateContent, function calling and structured output and supports every model, so the surface is available as GA, the reading Gemini Embedding takes on the same endpoint. Gemini Live keeps a deduction because the Live API runs on v1beta only (10). Before 13 October the only Pro model was gemini-3.1-pro-preview (5 of 10).

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Gemini Developer API 72

Closed service with clear terms, SDKs Apache-2.0 (15). Terms, pricing page and logs policy agree that free-tier data improves Google products and paid data doesn't, but abuse retention on paid services has no number, and the 26 October changelog entry turns on request storage by default for new paid projects while existing projects keep their setting (20 of 30). Deprecations table with earliest shutdown dates, exact dates promised later (15 of 20). Terms say data may be cached in any country where Google has facilities. No subprocessor list checked (5 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Gemini Developer API 83

Model reading. gemini-4-argon went GA on 13 October and the newest changelog entry, on 30 October, takes the Computer Use tool to GA (30). The deprecations page lists earliest possible shutdown dates and promises advance notice, with no stated minimum, and deep-research-pro-preview-12-2025 was announced on 8 October for shutdown on 23 October (4 of 12). Shutdown dates in the 90 days from 3 August include Imagen 4 on 17 August, Robotics ER 1.6 on 31 August, antigravity-preview-05-2026 on 5 October, the Veo 3.1 previews and gemini-omni-flash-preview on 22 October and deep-research-pro-preview-12-2025 on 23 October, each in the table with a replacement, and 3.7 and 3.5 Flash were deprecated on 8 October with requests routed to newer models (4 of 8). 16 dated changelog entries from 13 August to 30 October (15 of 15). SDK repository replies not sampled (5 of 10). Current official SDKs, google-genai 2.34.0 and @google/genai 2.32.0, both tagged on 29 October, with releases about weekly through October (15). Supported runtimes stated, Python 3.11 and later since 2.34.0 dropped 3.10, Node 20 and later (10).

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).