Gemini Live API vs Inworld Realtime API

Gemini Live API 41

Graded as a hosted API on the Gemini Developer API. A status page exists at aistudio.google.com/status, but on 4 November it still returned a script shell titled "Google AI Studio" with no components or history we could read (10 of 20, and 5 of 30 for the incident line with no readable record). Session limits are published, 15 minutes for audio and 2 for audio with video without compression, connections of about 10 minutes, and spend limits per 10 minutes of $10 on Tier 1 and $200 on Tiers 2 and 3. Per-model request limits and concurrent sessions are shown only in AI Studio, so the earlier partial 8 of 15 is kept. The server sends a GoAway message with timeLeft before closing, session resumption handles last 2 hours, and the troubleshooting guide gives exponential backoff with jitter for 429 and 503 (12 of 15). No SLA found for the Developer API (0). gemini-3.8-live is stable and generally available since 15 September, but the endpoint is v1beta, ephemeral tokens are in preview and the capabilities guide and API reference still label the Live API a preview, so the earlier partial 6 of 10 is kept.

Inworld Realtime API 62

Hosted reading of the checklist. status.inworld.ai is a public status page (20), with history we couldn't read, as on inworld-tts (5). Concurrent sessions are published per plan, 10 on On-Demand up to 1,000 on Growth (15). The rate limits page gives exponential backoff with jitter and Retry-After on longer windows, and sessions emit rate_limits.updated, with nothing on reconnecting a dropped session (12 of 15). An SLA appears only in the Enterprise column, with no terms (0). No preview or beta label on the Realtime API (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.

Gemini Live API 83

google-genai 2.34.0 (29 October 2026) changes the Live client, adding base_url, api_version and headers to LiveConnectConfig.http_options and a header fix in live.py, 6 days before the check (30). In the 90 days from 6 August, the changelog's gemini-3.5-transcribe-live (26 August) and 3.8 Live GA (15 September) entries, and Python SDK releases that change Live code, 2.18.0 (12 August), 2.19.0 (19 August), 2.23.0 (10 September), 2.26.0 (30 September), 2.30.0 (13 October), 2.32.0 (21 October), 2.33.0 (22 October) and 2.34.0 (29 October) (20). Closed service with a changelog updated several times a month. Support channels were not tested (10 of 15). Current official SDKs, google-genai v2.34.0 and @google/genai v2.32.0, both tagged 29 October (15). Apache-2.0 SDKs with type-check workflows in the Python repository and Node 20 or later stated. CI results were not read (8 of 10).

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

Gemini Live API 48

Keys created since 28 May 2026 are authorisation keys bound to a service account and restricted to the Gemini API, with IP and origin restrictions, a leak checklist and rejection of unrestricted standard keys. Ephemeral tokens add expiry and use counts (25 of 30). The WebSocket guide, re-read on 4 November, still documents the API key as a key query parameter and ephemeral tokens as an access_token query parameter, so we deduct 10 on that documentation (15 of 30). Ephemeral tokens can be locked to a model and configuration and to one session, which keeps system instructions server side. There is no approval step for tool calls, which the client runs itself (12 of 20). The model hears callers and can ground on Google Search, and the best practices page covers guardrails in system instructions but not prompt injection (5 of 15). Opt-in logs exist for billed projects, and we did not confirm they cover Live sessions. Usage is visible per project (8 of 15). security.txt on google.com valid to 2030 with a vulnerability reward programme. No certification naming the Developer API was found (8 of 20).

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

Gemini Live API 72

Closed service with clear terms, SDKs under Apache-2.0 (15 of 30). The terms, pricing page and zero data retention page agree that free-tier content improves Google products and paid content does not. The terms say abuse logs are kept for a limited period and the abuse monitoring page gives 55 days. Session state is kept up to 24 hours when resumption is on, and Search grounding data 30 days (20 of 30). A deprecations table gives earliest shutdown dates and replacements, with 17 November 2026 for the two older Live previews, about nine weeks after the replacement shipped, and no stated minimum notice (15 of 20). The terms say data may be stored transiently or cached in any country where Google has facilities. The Data Processing Addendum applies to paid services, and no sub-processor list was read (5 of 20).

Inworld Realtime API 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI (15). The ZDR page says what a session keeps and that third-party LLM requests aren't covered, but the terms and privacy notice disagree on training (12 of 30). Release notes flag potentially breaking changes with the clients affected and what to do, without stating a notice period (14 of 20). US headquarters with EU and India residency on Enterprise, and no sub-processor list in the docs, while sessions may route to third-party LLM providers (10 of 20). Total 51.

Gemini Live API 66

No AsyncAPI or similar file for the WebSocket messages was found. The keyless Discovery document (revision 20261006) types auth_tokens.create and five related schemas, BidiGenerateContentSetup among them, but not the client and server messages (8 of 25). llms.txt with a Markdown twin of every page (10). The capabilities guide, model comparison table and best practices page say when to use each model, voice activity mode and tool behaviour (16 of 20). The reference at aistudio.google.com/api-reference/live lists every message with field types, enums such as ActivityHandling, TurnCoverage and the sensitivity levels, and required marks, as tables and not as a schema (12 of 15). Python and JavaScript examples on every guide, but no list of WebSocket close codes or Live error responses was found (8 of 15). Dated changelog and versioned model names, less 3 because the tools page omits the 3.8 models, the overview says 70 languages where the capabilities guide lists 99, and preview banners remain on two pages after general availability (12 of 15). Docs moved from ai.google.dev to aistudio.google.com by 4 November 2026; the pages not re-read stand per the 8 October check.

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.