Hugging Face Inference Providers vs OpenRouter

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

OpenRouter 55

Status page at status.openrouter.ai, which rendered only in a browser with its feed and JSON paths answering 403 on 1 and 2 October. On 1 November its robots.txt answered 403 AccessDenied, so the host is treated as blocked and the page was not read (10 of 20, per the 2 October check, and 5 for the incident line, no readable history). The limits page gives 20 requests a minute on free models, 50 a day below $10 of lifetime purchases and 1,000 a day above, no platform cap on paid models, and a key endpoint that reports what's left (15). The errors page says 429, 503 and 402 responses from the in-flight spending budget carry Retry-After, tells clients to honour it, and says the official SDKs already do (15). The pricing page lists 'Contractual SLAs' for Enterprise without publishing terms, which we count as no published SLA (0). The chat completions API is GA (10). Model fallbacks through a models list soften an upstream outage, which this checklist doesn't score.

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

OpenRouter 90

Public OpenAPI document at openrouter.ai/docs/openapi/openapi.yaml (25). llms.txt with Markdown twins (10). Reference not read in full (15 of 20). Structured outputs documented, enforcement depends on the upstream model (10 of 15). Errors and debugging page and examples throughout (15). An API changelog generated from OpenAPI diffs on every release, with a human-reviewed Breaking section and migration notes, dated entries to 29 October 2026, and an API versioning page (15).

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

OpenRouter 85

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).

Hugging Face Inference Providers 20

No x402, MPP or L402 (0). Per-token prices for every model and provider published without a login in the router's /v1/models and on model pages (20). No free tier since 7 October 2026, when free users lost their included monthly credits; PRO's $2.00 of credits needs a subscription (0). Sign-up, token creation and credit purchase are browser steps (0).

OpenRouter 40

No machine payment protocol found in the docs index. Credits can be bought in USDC through Coinbase, but calls draw on a prepaid balance (0). Per-token prices published per model without a login (20). 25 or more free models with no card, per the listing (20). Browser sign-up for the first key (0). Management API keys and OAuth PKCE mint keys in code, but only after a person has an account.

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

OpenRouter 67

Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets data_collection to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request zdr filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).