Nebius AI Cloud vs Vast.ai

Nebius AI Cloud

One API definition generates the REST and gRPC interfaces, the CLI, Terraform provider and three SDKs, with a 602-operation OpenAPI document, X-Idempotency-Key and role-scoped service accounts. The status page lists 14 major incidents between 14 July and 8 October 2026, no request rate limits were found, and signup needs a browser and a card.

Vast.ai

API keys can be limited by permission category and by resource ID, the REST API has a public OpenAPI 3.1 file, and the CLI ships weekly with a skill file for coding agents. Machines belong to independent hosts, prices move with the market, rate-limit thresholds are unpublished, and there is no SLA or free tier.

Nebius AI Cloud

1. Use a service account with an authorised key, then exchange a five-minute RS256 JWT at https://auth.eu.nebius.com/oauth2/token/exchange for a 12-hour Bearer token
2. Send X-Idempotency-Key with a random UUID on every create, update and delete, since a 504 can follow a call that succeeded
3. Poll the returned operation (/ai/v1/endpoints/operations/{id}) until status is set; concurrent operations on one resource are not supported
4. Stop or delete endpoints when idle. A stopped endpoint bills nothing, a stopped Devlab or VM still bills for its disk
5. Check region support first. Serverless AI is absent from eu-south1 and us-north1, and each GPU platform exists in one to four regions
6. Run the beta nebius/mcp-server with safe mode on (the default); nebius_cli_execute can run any CLI command when SAFE_MODE=false

Vast.ai

1. Create a scoped key with vastai create api-key --permissions for the agent. A default key has full account access, billing and key management included
2. Pass --raw on every CLI command for JSON output, and -y on vastai destroy instance, which otherwise waits for a confirmation prompt
3. Register an SSH key with vastai create ssh-key before creating an instance, or the host is unreachable
4. Destroy instances when finished. A stopped instance still bills storage, and a zero balance without a saved card leads to deletion
5. Back off on HTTP 429 yourself when calling REST directly. The CLI retries 429 three times from 0.15 seconds
6. Filter searches with verified=true or the Secure Cloud option for sensitive data, and set a dph_total price cap