OpenRouter vs xAI API (Grok)

OpenRouter 67

Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets data_collection to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request zdr filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

OpenRouter 40

No machine payment protocol found in the docs index. Credits can be bought in USDC through Coinbase, but calls draw on a prepaid balance (0). Per-token prices published per model without a login (20). 25 or more free models with no card, per the listing (20). Browser sign-up for the first key (0). Management API keys and OAuth PKCE mint keys in code, but only after a person has an account.

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

OpenRouter 72

Closed service with clear terms, SDKs Apache-2.0 (15). Data collection page and privacy policy agree that content isn't stored unless you opt in, but training defaults for upstream providers sit on other pages we didn't read (15 of 30). An API versioning page states how deprecations are announced (in the changelog, with the field or endpoint marked deprecated in the reference) and the changelog dates each one, but no notice period is promised (12 of 20). Each provider's data policy is shown per endpoint per the listing, and EU or US in-region routing is part of the Business plan. No subprocessor list checked (15 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

OpenRouter 85

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

OpenRouter 82

Model reading. The TypeScript and Python SDKs were tagged on 31 October 2026, v1.5.33 and v1.3.106, and the API changelog's newest entry is 29 October (30). The versioning page says breaking changes are reviewed by a person and published in the changelog with migration notes, and that removing a deprecated part of the API follows that process, but it states no notice period. The 25 July Responses GA entry still promises a sunset date before the beta aliases go (6 of 12). Several removals of OpenRouter's own surface in the 90 days from 3 August, each published the day it shipped, sleep_after_seconds and the ncompass provider on 8 September, the /interns endpoints on 23 October, and the Python SDK's end_users namespace in 1.3.70 on 21 October (4 of 8). Dated changelog for every release that changes the spec, support not checked (12 of 15). SDK issue replies not sampled (5 of 10). Official SDKs in TypeScript and Python (and Go, not re-read on 1 November), generated from the OpenAPI document with Speakeasy, 242 and 279 tags since 3 August (15). Each SDK repository runs PR validation and publish workflows, per the 2 October check (10).

xAI API (Grok) 77

Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, grok-voice-transcribe-1.0 on 2 October and grok-imagine-image-quality on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, xai-sdk 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).