An investigation by Matt Lenhard examines a marketplace that has developed around reselling access to large language models (LLMs) through proxy services that pool multiple API keys. According to the report, this phenomenon appears to be concentrated primarily in China.
How the scheme works
Resellers operate LLM proxies backed by a pool of API credentials and route user requests through those proxies. Buyers connect to the reseller’s proxy rather than directly to the model vendor, and the reseller’s pooled keys are charged for the usage.
The report identifies several methods resellers use to lower their costs:
- abusing free trial offers,
- proxying through unprotected support bots,
- in some cases using stolen credit cards or performing chargeback attacks.
Open-source proxy software is central
The proxies are often built on open-source projects, notably one-api and its more actively developed fork, new-api. Both are legitimate API proxy tools that enable load balancing of requests across a set of API credentials, but they can also be repurposed to run the reseller services described.
Why this matters
The practice raises several concerns:
- increased fraud and payment abuse risk (compromised cards or chargebacks),
- circumvention of geographic restrictions as customers seek cheaper or otherwise blocked access,
- collection of large datasets for model distillation or other potentially improper uses.
The investigator notes that the existence of this ecosystem amplifies developers’ reluctance to expose LLM-powered applications publicly, due to the risk of unexpectedly high token bills.
Implications for LLM vendors
Lenhard argues that LLM providers need to improve how they support strict caps and billing controls for API keys. He suggests that vendors should offer the ability to enforce hard spending limits (for example, immediately halting access when a preset dollar threshold is reached for a given period).
Sources
The primary source for the piece was a Chinese-language forum thread cited by Matt Lenhard and picked up in discussion on Hacker News. The reporting highlights that while the underlying proxy software is legitimate and open source, the commercial ecosystem built around it contains significant operational and ethical risks.
Note: This article summarizes the findings reported by Matt Lenhard and publicly available discussions; it does not assert additional facts beyond those sources.
