Hugging Face Inference Providers vs Novita AI

Hugging Face Inference Providers 20

No x402, MPP or L402 (0). Per-token prices for every model and provider published without a login in the router's /v1/models and on model pages (20). No free tier since 7 October 2026, when free users lost their included monthly credits; PRO's $2.00 of credits needs a subscription (0). Sign-up, token creation and credit purchase are browser steps (0).

Novita AI 35

No machine payment protocol was found in the docs index, the site map, the pricing page or the skill repository (0). Per-token prices for each model on the pricing page without a login, such as deepseek/deepseek-v4.1-flash at $0.30 in and $1.20 out per 1M tokens (20). Two language models are listed as free and the FAQ describes a voucher for new users. Whether a card is needed to use either was not stated in the pages read (15 of 20). A person signs up in a browser, keys are created only in the console, and the OAuth route needs the user to sign in and approve (0). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

Novita AI 72

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). tools with a strict flag and a worked example. The list of models that support it is drawn by script, and tool_choice is absent from the chat reference (13 of 20). response_format takes json_object and json_schema with strict in the reference, while the FAQ says only json_object works (9 of 15). Prompt caching is automatic on supported models, cache-read prices are on the pricing page and cached_tokens is returned in usage (12 of 15). Context of 1M tokens on DeepSeek V4, GLM 5.3 and Kimi K3 per the pricing page. Output caps were not read (12 of 15). OpenAI-style files and batches with a 24-hour window, one model per file and an introductory 50 per cent discount (10). The OpenAI client works with a changed base URL. Both vendor SDK repositories are archived (5 of 10). Named error codes, a 429 that separates request and token limits, and a trace_id for support (11 of 15). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

Novita AI 65

Model reading. Bearer keys with the sk_ prefix, shown once, up to 10 an account, with an expiry of 24 hours, 30 days, 90 days or none fixed at creation, deletable in the console, and a per-key model access policy and source IP allowlist that can be set by API. OAuth with PKCE and the scopes api and balance:read is described in auth.md, with no token revocation endpoint. No documented way to send a key in a URL was found (26 of 30). The terms, re-read on 4 November and still updated 5 August 2026, say content is not used to train Novita's models or improve the services by default (17 of 20). The terms state zero data retention, with exceptions for law and for what is necessary to run or support the service, and allow automated safety screening. Batch input files are kept for 15 days (11 of 15). Billing can be queried per key, and budget, monitoring and metrics pages are listed in the docs index and were not read (7 of 15). The trust centre at trust.novita.ai is drawn by script and was not read. /.well-known/security.txt returns 404, and no disclosure policy or bug bounty was found (4 of 20). The key, retention and trust-centre readings are per the 9 October check, not re-read on 4 November.

Hugging Face Inference Providers 80

Model reading. huggingface_hub 2.4.0 tagged on 29 October 2026 and the Inference Providers docs updated daily by an automated job, last on 6 November (30). huggingface_hub 2.2.0, 2.3.0 and 2.4.0 and @huggingface/inference 4.13.28 to 4.13.32 in the 90 days (20). No dedicated changelog; the Hub has a forum and Discord, and GitHub issue replies were not read (8 of 15). Current official SDKs in Python and JavaScript (15). The Python client supports Python 3.10 and later, per the Inference Endpoints check; CI not read (7 of 10).

Novita AI 66

Model reading. Changelog entries per the 27 October reading of each entry page, not re-read on 4 November because Novita's terms bar automated access to the site and its linked channels. The newest entry is dated 22 October 2026 (30). Retirement notices carry a UTC time and a replacement, with notice of 1 day (22 October for xiaomimimo/mimo-v2.5 at 00:00 UTC on 23 October) to 29 days (1 September for multimodal models on 30 September). No written notice period was found (6 of 12). Nine dated entries in the 90 days from 6 August (1, 8, 18, 20, 23 and 28 September, 15, 19 and 22 October), each read on its own page (8 of 8). A dated changelog, a Discord server and a support address per the 9 October check (12 of 15). novitalabs/python-sdk and novitalabs/javascript-sdk are archived, unchanged since 8 November 2024 and 4 March 2025, and issue replies were not examined (2 of 10). The docs rely on the OpenAI client, the SDK page still named the two archived packages on 9 October, and the skill repository is unchanged since 24 September 2026 (5 of 15). The JavaScript SDK repository has a publish workflow only and the Python one has none (3 of 10). 30 + 6 + 8 + 12 + 2 + 5 + 3 = 66.

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

Novita AI 57

Closed service. The terms set Delaware law and arbitration but name the party only as Novita AI, with no corporate form or address. The skill and the MCP server are MIT (10 of 30). The terms state zero data retention and no training by default, and the privacy policy lists retention periods (account data for the life of the account plus 7 years, technical data 2 years). The privacy policy says it does not cover content processed for customers and points to customer agreements. No DPA was found (16 of 30). Retirement notices in the changelog carry a UTC time and a replacement. The terms reserve the right to discontinue any service without notice (12 of 20). The privacy policy names categories of recipients only and transfers that include the United States. No sub-processor list was found (4 of 20). Per the 9 October check, not re-read on 4 November, as the terms bar automated access to the site and docs.