Tencent Cloud TokenHub vs xAI API (Grok)

Tencent Cloud TokenHub 71

Router, read on the model lines. Bearer keys can be limited to chosen models and inference services, up to 200 source IP ranges and daily, monthly or total token quotas, can be disabled or deleted, and can be created in code through CreateApiKey with signed Tencent Cloud credentials. Keys are long-lived with no expiry setting or built-in rotation (26 of 30). Clause 2.17 of the terms says inputs are not used to train Tencent Cloud's own models, and the FAQ says data is not used for training. Inputs to third-party deployed models (DeepSeek's directly supplied ones) go to DeepSeek under its terms (14 of 20). Clause 2.14 keeps data only as long as the service needs, with no periods stated. When a customer asks for generated content without AI labels, Tencent Cloud keeps logs of who received it for at least six months. No zero-retention option was found (7 of 15). Per-call audit logs (request ID, key, client IP, status, tokens, latency) and optional full call logs go to the customer's CLS, billed separately, with usage by key and a monitoring dashboard (14 of 15). No security.txt on cloud.tencent.com, www.tencent.com or tokenhub.tencentmaas.com (404). Tencent's bug bounty through TSRC lists Tencent Cloud in scope. No certification for TokenHub was checked (10 of 20).

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Tencent Cloud TokenHub 73

Router, scored on the API lines. No OpenAPI file for the inference routes. Field pages document the OpenAI Chat Completions, OpenAI Responses and Anthropic Messages formats as TokenHub implements them, and the control plane is a Tencent Cloud API 3.0 service (version 2026-03-22) with typed parameters, API Explorer and SDKs (12 of 25). An llms.txt at cloud.tencent.com/document/product/1823/llms.txt links a Markdown copy of each docs page (10). The docs say which models support thinking, tools, structured output and caching, how TokenHub departs from each standard protocol, and which DeepSeek model suits which job. The quickstart's examples still use deepseek-v3, which is not in the model list, and Qwen3.5 stays in the list with a past shutdown date (13 of 20). Protocol pages list each field with type, required flag and default, and control-plane parameters carry enums and required flags (10 of 15). Examples in curl, Python, Node.js, Java and Go, and an error page listing 30 codes with HTTP status, cause and fix (14 of 15). Paths carry /v1, release notes are dated monthly from 7 April to 24 October 2026, and the control-plane API has a dated history of 26 releases to 18 September 2026 (14 of 15).

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).

Tencent Cloud TokenHub 35

No x402, MPP or L402 (0). Per-token prices for every model are public in CNY for Guangzhou and Singapore, with DeepSeek's peak and off-peak rates (20). Each account gets 1M free tokens per language model, valid for a year, in a campaign running to 31 December 2026. No card is mentioned, but the account needs real-name verification, so this line takes 15 of 20. A person signs up and completes real-name verification in a browser. Keys can then be created in code or by thcli auth login, but only from that account (0).

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Tencent Cloud TokenHub 46

Hosted reading. No public status page was found. status.cloud.tencent.com did not answer and the Tencent Cloud health dashboard documentation answered with a bot check (0). With no page there is no incident record to read (5 of 30). The announcements carry one incident, DeepSeek's directly supplied models unavailable from 9:06 to 13:04 Beijing time on 15 October 2026 after a fault at DeepSeek, compensated with vouchers. Rate limits are per model, shown in the console and returned by DescribeModelQuota. The public docs give numbers only for batch jobs (20 created a minute, 10 active), image models (5 concurrent) and DeepSeek V4 Flash and Pro (2,500 and 500 concurrent), with the rules for self-serve increases (8 of 15). Six 429 codes separate RPM, TPM, TPD, concurrency and upstream capacity, 429s may carry Retry-After and the docs advise exponential backoff. No idempotency guidance, though inference calls are not writes (13 of 15). The TokenHub SLA promises 99.5% monthly availability with vouchers of 10, 25 or 50 per cent of the month's fee. It excludes free use and third-party deployed models such as DeepSeek's directly supplied ones (10). Generally available since 7 April 2026, with some models marked preview (10).

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Tencent Cloud TokenHub 54

Closed service under the TokenHub Terms of Service (effective 14 September 2026), the SLA (23 April 2026), a special note on third-party deployed models and the Tencent Cloud Service Agreement, naming Tencent Cloud Computing (Beijing) Co., Ltd. The CLI is Apache-2.0 (18 of 30). The terms and the FAQ agree that inputs are processed on the customer's instructions and not used for training, and clause 2.14 limits retention to what the service needs without periods. The TokenHub privacy policy on privacy.qq.com renders only with JavaScript and was not read (15 of 30). Dated retirement notices, shutdown dates in the model list, a pre-offline status in /v1/models and a DiscontinuedAt field in the control API. Clause 6.3 refunds paid, unused tokens when a third-party model is removed. No minimum notice period is written (13 of 20). Clause 2.13 places processing generally in mainland China for the China site and in Singapore for the international site, and the third-party model list names DeepSeek's Hangzhou company with a link to its terms. No subprocessor list was found (13 of 20).

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Tencent Cloud TokenHub 83

Router, read on the model lines. Function calling is marked on most chat models in the model list, with behaviour depending on the model routed (14 of 20). Structured output is marked per model and missing on the MiniMax and Qwen models, and an unsupported response_format returns code 400006 (12 of 15). Cache-hit prices are published per model, Kimi K3.1 Pro lists five-minute and one-hour cache writes, and a guide covers prompt_cache_key and the X-Session-ID header for instance affinity (14 of 15). Most listed chat models have contexts of one million tokens, a judgement call since a router has no default model (15). Batch at half price covers only Hy3 and Hy4 preview, reads and writes JSONL in the customer's own COS bucket and is documented for the Guangzhou endpoint (5 of 10). No TokenHub inference SDK. The OpenAI and Anthropic SDKs work with a changed base URL, and Tencent Cloud SDK 3.0 and the thcli CLI cover the control plane (8 of 10). Errors return a code, English and Chinese messages, the source, the upstream code and status and a request ID, and stream errors arrive as SSE error frames (15 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).