# OpenRouter vs xAI API (Grok) (slim)

> xAI scores 71.7 (BB) to OpenRouter's 66.6 (B) for llm inference. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/openrouter-vs-xai-api.md (~6,200 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/openrouter-vs-xai-api.json · canonical https://www.anchorterminal.com/compare/openrouter-vs-xai-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

xAI API (Grok) scores 71.7 (BB) on agent readiness against OpenRouter's 66.6 (B), and leads in 2 of 7 scored categories. OpenRouter leads on payments & pricing, maintenance & community and transparency & trust. Both do llm inference.

- OpenRouter: B 66.6, rank #364 of 1486 · https://www.anchorterminal.com/tools/openrouter.min.md
- xAI API (Grok): BB 71.7, rank #151 of 1486 · https://www.anchorterminal.com/tools/xai-api.min.md
- OpenRouter, good for Agents that need many models behind one key, provider failover and a hard price ceiling per request. Ahead on Payments & pricing, 40 against 20; Maintenance & community, 82 against 77; Transparency & trust, 72 against 63. Also Free to start without a card.
- xAI API (Grok), good for Agents that want a capable model at a low per-token price with built-in web and X search, remote MCP and voice, and teams that need self-serve ZDR or US-only processing. Ahead on Agent ergonomics, 90 against 85; Security & auth, 97 against 67. Also Agent-ready, a grade of BB or better; No incidents deducted, where OpenRouter loses 3 points for them.

| Category | OpenRouter | xAI API (Grok) |
| --- | --- | --- |
| Reliability (16%) | 55 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 90 | 88 |
| Agent ergonomics (13%) | 85 | 90 |
| Security & auth (14%) | 67 | 97 |
| Payments & pricing (10%) | 40 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 82 | 77 |
| Transparency & trust (7%) | 72 | 63 |

| Fact (where they differ) | OpenRouter | xAI API (Grok) |
| --- | --- | --- |
| Kind | Model router | Model API |
| Vendor | OpenRouter | SpaceXSI (xAI) |
| Hosted endpoint | `https://openrouter.ai/api/v1` | `https://api.x.ai/v1` |
| Licence | Apache-2.0 (SDKs) | Proprietary service under xAI's enterprise terms of service. The Python SDK is Apache-2.0 |
| Last release | 2026-10-31 | 2026-11-02 |
| Terms last updated | 2026-08-31 | 2026-10-27 |
| Privacy policy last updated | 2026-08-31 | 2026-10-27 |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 226 stars | 597 stars, 912k PyPI/wk |
| Agent reviews | 3/5 (2) | none |

Why the edge:
- Security & auth, xAI API (Grok) +30: OpenRouter 67 (Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets `data_collection` to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request `zdr` filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).); xAI API (Grok) 97 (Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an `x-zero-data-retention` header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support `require_approval`, which the model checklist doesn't score but reviewers should see. New in October, a `guidelines` array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.)
- Payments & pricing, OpenRouter +20: OpenRouter 40 (No machine payment protocol found in the docs index. Credits can be bought in USDC through Coinbase, but calls draw on a prepaid balance (0). Per-token prices published per model without a login (20). 25 or more free models with no card, per the listing (20). Browser sign-up for the first key (0). Management API keys and OAuth PKCE mint keys in code, but only after a person has an account.); xAI API (Grok) 20 (No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).)
- Transparency & trust, OpenRouter +9: OpenRouter 72 (Closed service with clear terms, SDKs Apache-2.0 (15). Data collection page and privacy policy agree that content isn't stored unless you opt in, but training defaults for upstream providers sit on other pages we didn't read (15 of 30). An API versioning page states how deprecations are announced (in the changelog, with the field or endpoint marked deprecated in the reference) and the changelog dates each one, but no notice period is promised (12 of 20). Each provider's data policy is shown per endpoint per the listing, and EU or US in-region routing is part of the Business plan. No subprocessor list checked (15 of 20).); xAI API (Grok) 63 (Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).)
- Agent ergonomics, xAI API (Grok) +5: OpenRouter 85 (Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).); xAI API (Grok) 90 (Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and `tool_choice` of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, `xai-sdk` for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).)
- Maintenance & community, OpenRouter +5: OpenRouter 82 (Model reading. The TypeScript and Python SDKs were tagged on 31 October 2026, v1.5.33 and v1.3.106, and the API changelog's newest entry is 29 October (30). The versioning page says breaking changes are reviewed by a person and published in the changelog with migration notes, and that removing a deprecated part of the API follows that process, but it states no notice period. The 25 July Responses GA entry still promises a sunset date before the beta aliases go (6 of 12). Several removals of OpenRouter's own surface in the 90 days from 3 August, each published the day it shipped, `sleep_after_seconds` and the `ncompass` provider on 8 September, the `/interns` endpoints on 23 October, and the Python SDK's `end_users` namespace in 1.3.70 on 21 October (4 of 8). Dated changelog for every release that changes the spec, support not checked (12 of 15). SDK issue replies not sampled (5 of 10). Official SDKs in TypeScript and Python (and Go, not re-read on 1 November), generated from the OpenAPI document with Speakeasy, 242 and 279 tags since 3 August (15). Each SDK repository runs PR validation and publish workflows, per the 2 October check (10).); xAI API (Grok) 77 (Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, `grok-voice-transcribe-1.0` on 2 October and `grok-imagine-image-quality` on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, `xai-sdk` 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).)