Inworld Realtime API vs OpenAI Realtime API

Inworld Realtime API 63

Closed service with clear terms naming Theai, Inc. dba Inworld AI (15). The ZDR page says what a session keeps and that third-party LLM requests aren't covered, but the terms and privacy notice disagree on training (12 of 30). Release notes flag potentially breaking changes with the clients affected and what to do, without stating a notice period (14 of 20). US headquarters with EU and India residency on Enterprise, and no sub-processor list in the docs, while sessions may route to third-party LLM providers (10 of 20). Total 51.

OpenAI Realtime API 90

Closed service with clear terms, per the OpenAI API listing's check of the services agreement, which answered 403 to our reader again on 2 November. The Agents SDK for TypeScript and the OpenAPI file are MIT (15, was 10). The data controls page, re-read on 2 November, lists /v1/realtime with no training use, abuse monitoring logs kept up to 30 days, no stored application state and Zero Data Retention eligibility. The DPA, effective 1 January 2026, commits to return or deletion of customer data on termination, 30 days to object to a new subprocessor, and SCCs with the UK Addendum, and nothing in it conflicts with the guide, per the OpenAI API listing's 4 October check, not re-read on 2 November. The same reading as the other OpenAI listings (30, was 18). The deprecations page, re-read on 2 November, states at least six months' notice for generally available models and lists shutdown dates with replacements, including gpt-realtime and gpt-realtime-mini on 20 January 2027 (20). The guide documents residency for /v1/realtime in the United States and Europe for storage and processing, with a sip-eu.api.openai.com endpoint, and says tracing on /v1/realtime isn't EU residency compliant. The subprocessor list, updated 9 July 2026, names third-party subprocessors and OpenAI affiliates with processing countries for each and a form for notice of new ones, per the OpenAI API listing's 4 October check, not re-read on 2 November. The guide states the residency limit, which counts as disclosure, so the same reading as the other OpenAI listings (20, was 10). 15 + 30 + 20 + 20 = 85.

Inworld Realtime API 58

Workspace API keys sent as Basic credentials, deleted to revoke, with separate keys per environment advised. The CLI mints read-only keys unless --write is given, but write toggles cover only the Voice and Router APIs, so no key is limited to one product. Browsers use short-lived tokens minted server side. Session IDs, not secrets, go in the URL (25 of 30). Tools run in the client, so the developer approves side effects, with no approval step in the API (10 of 20). The agent listens to callers and passes their speech to an LLM, and no prompt-injection guidance was found (5 of 15). Usage per key and a Performance page with errors and throttling (8 of 15). SOC 2 Type II and HIPAA claimed and a vulnerability report form, with no security.txt or bug bounty, per the 4 November reading (10 of 20). Total 58. Zero data retention covers session content from the Developer plan up, but not requests routed to third-party LLM providers.

OpenAI Realtime API 83

Server connections send the API key as a Bearer header. Browsers use client secrets from POST /v1/realtime/client_secrets that last 10 seconds to 2 hours, 10 minutes by default, and can open several sessions until expiry, and the browser WebSocket example passes the secret as a subprotocol, not in the query string. Project keys take All, Restricted or Read Only permissions, with service accounts, workload identity federation and mutual TLS, per the OpenAI API listing's check. The permissions guide, read on 2 November, puts /v1/realtime under one Model capabilities permission with chat completions, audio, embeddings, images, moderations and responses, so a restricted key can't be limited to Realtime alone (27 of 30, as the OpenAI Speech-to-text listing, was 24 when key scopes were unread). MCP tools take allowed_tools and require_approval, which defaults to always in the OpenAPI file, and a sideband connection keeps tool execution on the server. Session settings attached to a client secret can be overridden by the client connection (15 of 20). The model hears callers and reads MCP results. The SIP guide says to treat SIP headers as untrusted, and no prompt-injection guidance specific to Realtime was found, per the 9 October check (6 of 15). The Admin APIs include audit log retrieval, and since 4 August 2026 the Usage and Costs dashboards and APIs filter and group by API key, the per-key view the other OpenAI listings get 15 for. The Usage API has no Realtime-specific endpoint (15, was 10). openai.com's security.txt, read on 2 November, is PGP-signed with a Bugcrowd programme, a disclosure email and a coordinated disclosure policy, and has no Expires field. trust.openai.com, read on 2 November, names SOC 2 Type 2, ISO/IEC 27001, 27017, 27018, 27701 and 42001 and CSA STAR (20, was 6 when openai.com refused our reader, the award the other OpenAI listings carry). 27 + 15 + 6 + 15 + 20 = 83.

Inworld Realtime API 60

No AsyncAPI or other machine-readable file for the socket, and the spec paths redirect (0). llms.txt, Markdown twins and a docs MCP server (10). The overview, OpenAI migration guide, providerData reference and the billing page's account of how a session is counted say what to use when (16 of 20). The reference lists every client and server event with field types and required marks, as text rather than a schema (12 of 15). JavaScript and Python example projects and an error event with type, code and param, without a list of codes (9 of 15). Dated release notes with affected clients and required actions, but no API version beyond /v1 (13 of 15). Total 60.

OpenAI Realtime API 84

The OpenAPI 3.1 file in openai/openai-openapi (version 2.3.0, last committed 31 October 2026, read from a clone on 2 November) has nine /realtime paths and 185 Realtime schemas, with 11 client events and 46 server events in its main event unions and separate translation session events. It is not an AsyncAPI document, so the WebSocket channel itself is not described (22 of 25). llms.txt and a Markdown twin of every docs page, re-read on 2 November (10). The tools guide has a table of when to use function, mcp with server_url or a connector, and the transport guides say when to choose WebRTC, WebSocket or SIP, per the 9 October check (16 of 20). Session fields carry enums and ranges, such as expires_after.seconds from 10 to 7200, though model also accepts any string (13 of 15). Examples in JavaScript, Python, Java, Ruby and C#, an error event with type, code, message and param, and a list of common MCP failures. No catalogue of Realtime error codes was found (11 of 15). Dated changelog and dated snapshots for the older models (gpt-realtime-2.1 lists only its alias), less 3 because the OpenAPI file still names gpt-4o-realtime-preview models (12 mentions on 2 November) that the deprecations page says were removed on 7 May 2026, and several guides mix GPT-Live and Realtime text on one page (12 of 15). 22 + 10 + 16 + 13 + 11 + 12 = 84.

Inworld Realtime API 71

Release note of 16 October 2026 (cache_transcript), 21 days ago (30). Three dated Realtime entries in the 90 days from 8 August, on 14 September, 23 September and 16 October (20). Discord and support@inworld.ai, with no evidence of answers read (8 of 15). Works with OpenAI's Realtime clients and the CLI is current at 1.5.0, but there is no Inworld Realtime SDK (8 of 15). CLI on npm under MIT, CI not read (5 of 10). Total 71.

OpenAI Realtime API 82

The last dated changelog entry tagged v1/realtime is the 26 August 2026 deprecation of whisper-1, gpt-4o-transcribe and two related models, which Realtime sessions can use for input transcripts, after gpt-transcribe for committed Realtime turns on 28 July. The listing's own package, @openai/agents-realtime, released 0.21.0 on 20 October 2026, 13 days before the check, with Realtime fixes (WebRTC connections rejected when the server reports an error before the session is configured, Twilio audio defaults kept), read from a clone. A release that changes the product's own package sets the recency line in this run (30, was 20 when SDK releases weren't read on this line). In the 90 days from 4 August the changelog has one v1/realtime entry and the SDK has 11 version tags, 0.14.3 on 5 August to 0.21.0, at least seven of which change the Realtime package's source. SDK tags count half, so 1 + 3.5 clears three (20, was 0). Closed service with a changelog updated several times a week, plus a community forum and Discord linked from the docs, which we did not test (10 of 15). Current official SDKs, @openai/agents and @openai/agents-realtime 0.21.0 (15). The SDK is MIT but still 0.x, and its CI results were not read (7 of 10). 30 + 20 + 10 + 15 + 7 = 82.

Inworld Realtime API 40

No x402, MPP or L402 (0). No per-session price, but each billed part (STT per hour, TTS per character, LLM per token) is priced publicly (20). On-Demand includes free STT and TTS allowances and lists no payment method, though some premium LLMs need a card on file (20). A person signs up in a browser before a key exists (0). Total 40.

OpenAI Realtime API 30

No x402, MPP or L402 on the pricing page, re-read on 2 November, or in the OpenAPI file (0 of 40). Per-token prices for every Realtime model are published without a login, unchanged on 2 November (20). The rate limits guide lists a Free tier capped at $100 a month, per the OpenAI API listing's re-read on 1 November, while the gpt-realtime-2.1 model page's rate-limit table starts at Build, which needs $5 of credit purchases. Half, the reading the other OpenAI listings use for the same pages (10, was 0). API keys are created in the platform settings after a browser sign-in (0). 0 + 20 + 10 + 0 = 30.

Inworld Realtime API 68

Scored as an API. Conversation history defaults to the last 100 items, can be trimmed, and can be cached on Anthropic models, and every response.done carries a usage block (18 of 25). No lists to page. Output controls are modalities, turn detection settings, optional transcription and response.speak (12 of 20). Error events follow OpenAI's type and code shape, unsupported fields come back as non-fatal unsupported_field warnings, and item_not_found names the bad parameter (14 of 20). Tools run on the client and a follow-up response starts automatically after a tool result. Nothing covers side effects of a tool call cut off by an interruption (12 of 20). Works with OpenAI Realtime clients after changing the URL and key, with no Inworld Realtime SDK (12 of 15). Total 68.

OpenAI Realtime API 76

Read on the API lines, per the 9 October check of the guides, not re-read on 2 November. Context can be capped with truncation, retention_ratio and token_limits.post_instructions, items can be deleted, prompt caching is automatic, and response.done reports token usage by modality (22 of 25). There are no lists to page. Output controls are output_modalities, max_output_tokens, optional input transcription and allowed_tools (14 of 20). The error event returns the event_id of the client event that caused it, and MCP tool listing and calls have their own failure events (15 of 20). Client events take an event_id, webhooks carry a webhook-id, and interruptions cancel the response. No session resumption after a dropped connection and no idempotency key for call control were found (10 of 20). A session needs only a model, voice activity detection is automatic, and the Agents SDK starts a browser voice agent in about ten lines, with examples in five languages (15). 22 + 14 + 15 + 10 + 15 = 76.