research/llm-subscription-resale-markets/sources.md

title	description	status	category	tags	draft	created	updated
Sources — LLM Subscription-Resale Markets	Reference list for the subscription-resale inference market study, with what each source evidenced.	active	market	inference-market sources	true	2026-10-05	2026-10-05

Sources — LLM Subscription-Resale Markets

Part of llm-subscription-resale-markets/index

All accessed 2026-10-05, unauthenticated. Web pages fetched between 19:37 and 20:05 UTC; raw captures with URL + UTC timestamp provenance are kept in the workspace at RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/.

InferHub — first-party pages (the target of the study)

Source	What it evidenced
https://inferhub.dev/terms (last updated 2026-10-02)	§2 self-description as a subscription-reselling reverse proxy and marketplace; §5 acceptable use; §6 paid-vs-free resale rules; §7 publisher warranties + indemnity; §8 non-refundable balances and chargeback forfeiture; §10 no output-rights warranty
https://inferhub.dev/privacy (last updated 2026-06-17)	credential storage model (api_key_enc, oauth_refresh_enc, AES-256-GCM, in-process decrypt); 7-day retention of system prompt + tool definitions on security-policy rejection; 14-day retention of screened message text; the "keep content … off the provider accounts that serve you" screening rationale; sub-processors (PostgreSQL, Redis, NATS, Solana RPC, Cloudflare); data controller = the individual operator, jurisdiction undisclosed
https://inferhub.dev/	publisher pitch; "Real upstream quota tracking … live 5-hour and weekly usage windows"; "Per-provider outbound proxy pool routes your traffic through least-used egress"; live market ticker with per-slug asks (e.g. cc/claude-opus-5-5 ask $0.8); "Models reachable without buying the plan" table
https://inferhub.dev/pricing	full model table with official reference prices and per-tier asks/avail; the 50%-of-official cap statement; platform headline counts (14 upstreams / 155 model IDs / 74,310 active providers); minimum charge $0.00001; cache-badge definition
https://inferhub.dev/faq	"pools upstream LLM subscriptions … behind a single OpenAI- and Anthropic-compatible API"; bcrypt/argon2id/AES-256-GCM claims; publisher obligations
https://inferhub.dev/docs	routing tips: auto-routing with up to 5 hops; 429 capacity_saturated; 402 no_provider_under_bid; 503 no_capacity on monthly caps; x-ignore-upstream (reveals the unlisted qd prefix); the systemPromptNote / "Cursor prepends its own agent prompt" statement; free/<provider>/<model> naming
https://inferhub.dev/docs/api	three surfaces on one sk-airo- key: inference (api.inferhub.dev), management REST API, MCP SSE at /mcp/sse; combo/<slug> routing
https://inferhub.dev/docs/api/reference	rate limits (30 rpm management / 500 rpm inference per account); model-name formats; minimum-charge worked example; account_blocked semantics
https://inferhub.dev/status	status page shell (JSON is at /api/status)
https://inferhub.dev/refund-policy	non-refundable balance policy

InferHub — public API surface (no auth required)

Endpoint	Response	What it evidenced
GET /api/openapi.json	200, 138,946 bytes, 73 paths	the entire management + publisher API: bulk credential endpoints (antigravity/bulk, codex/bulk, codebuddy/refresh-tokens, recheck-bulk, invalid), quota artefacts (usage-windows, auto-reset-credit), upstreams/{slug}/max-concurrent, schedule, asks; "a single publisher can own six figures of credentials"; "Codex only; auto-spends real money"
GET /api/pricing/config	{"maxAskPctOfOfficial":0.5,"platformFeePct":0.2,"publisherSharePct":80}	the cap, the fee, and the publisher share in one request
GET /api/market	per-slug family, minAskIn/Out, maxAskIn/Out, lastRate	the 14 families; cc/claude-opus-5-5 minAsk $0.796 vs maxAsk $2.00 (the cap) and lastRate 0
GET /api/pricing/usage	24 h per-slug requests and token counts	measured volume: 5,684,357 requests, 406.5 bn input tokens, 9.62 bn output tokens, 152 slugs; the per-family split
GET /api/pricing/cache	per-slug prompt-cache hit rate	82.0% of all input tokens were cached in the window
GET /api/status	availability, error causes, per-family latency	API availability 24 h 96.4%; causes no_capacity 62.7% / upstream_failed 37.2%; claude-fable-5 35.07% 24 h; per-family TTFT 5–19 s
GET /v1/models (bogus bearer)	403 {"error":{"message":"access denied","type":"forbidden"}}	key validation; OpenAI-compatible error shape
GET /robots.txt, /sitemap.xml, /openapi.json	404	no robots/sitemap; the OpenAPI is served at /api/openapi.json

Client-side artefact

Source	What it evidenced
https://registry.npmjs.org/@inferhub%2Fhelper	package @inferhub/helper, maintainer exzork, first published 2026-07-15, 13 versions to 0.2.9; repo github.com/inferhub/helper (not publicly resolvable); homepage inferhub.dev
@inferhub/helper 0.2.9 tarball (dist/constants.js, dist/usage-plugins.js, dist/adapters/*, README.md)	which agent configs get rewritten (~/.claude/settings.json incl. ANTHROPIC_DEFAULT_OPUS_MODEL; ~/.codex/config.toml + auth.json; OpenCode / OpenClaw / Hermes); usage-plugin packages @inferhub/usage, @inferhub/opencode-usage reporting to GET /v1/me/usage; base URL https://api.inferhub.dev/v1
https://api.github.com/users/exzork	public profile linked to the npm maintainer handle; account created 2017, ~65 public repos, personal site exzork.me

CodeBuddy (Tencent) — the farmed free tier

Source	What it evidenced
https://www.codebuddy.ai/pricing	Free $0 = 100 credits/month, daily active reward 30 credits/day, 250 welcome credits, 5,000 completions; Pro $7 first month then $10/mo = 2,000 credits
https://www.codebuddy.ai/docs/ide/Account/pricing	Free 100 base credits, 30/day promotional bonus, "all models available during the promotional period", "Standard quotas resume when the promotion ends"
https://www.codebuddy.ai/docs/ide/Account/Subscription	full daily-bonus rules; "Activity Restrictions" banning scripts/plug-ins/emulators/API calls/bulk registration and malicious multi-account control; FAQ banning "bulk registration, account sharing, account trading"; non-transferable credits
https://intl.cloud.tencent.com/document/product/1256/77269	Free 100 credits/month; 250 new-user credits valid 14 days; Pro 7-day trial 500 credits; 30/50 credits-per-day bonus table
https://mvalentsev.github.io/awesome-free-ai-coding/providers/codebuddy/ (probe-verified 2026-10-05)	independent free-tier summary; the "does not resolve from US, India and Russia" finding (www.codebuddy.ai DNS answers 0.0.0.1 to client subnets there)

The credential resale market

Source	What it evidenced
https://mastumbas.id/product/codebuddy	CodeBuddy account (access token + refresh token) at Rp 2,300 (~$0.14), 450 credits + auto +30/day, 3,303 sold, wholesale to Rp 1,800 at ≥100; the seller's own description of what the token is for (9router, 28 models) and the full model-code list used for the slug comparison
Same page, adjacent listings	Cline accounts Rp 2,000 (cp/), "Refresh Token Codebuddy CN 4000-5000 Credit" Rp 15,000 (cbcn/), "Apikey Codebuddy Global 30000 Credit" Rp 100,000, a CodeBuddy-CN listing attributed to rdhx, Gemini Pro links, and 1-day Webshare datacenter/residential proxy packs

Upstream vendor terms

Source	What it evidenced
https://code.claude.com/docs/en/legal-and-compliance	"Customers may not pay for, resell, or intermediate Claude usage on their end users' behalf"; "may not … route requests through Free, Pro, or Max plan credentials on behalf of their users"; "may not collect, store, or intermediate Claude.ai credentials or session tokens"
https://www.anthropic.com/legal/consumer-terms, https://www.anthropic.com/legal/commercial-terms	Consumer vs Commercial ToS split (Free/Pro/Max vs Team/Enterprise/API) — cited by the Claude Code compliance page
https://support.claude.com/en/articles/8241253-safeguards-warnings-and-appeals	Anthropic enforcement surface: suspensions tied to Usage Policy, unsupported-location account creation, and ToS violations; appeal path
Secondary reporting on enforcement	Jan 2026 + Apr 2026 changes blocking subscription OAuth tokens in third-party harnesses; ban reports and appeal outcomes (news/community posts). Treated as secondary, not vendor-primary

Comparables and category context

Source	What it evidenced
https://www.surplusintelligence.ai/	same mechanic on different rails — "Open Market for Models", "your surplus capacity sold to the highest bidder", "list your API credits", Base-native, SURPLUS token
https://inferencehub.tech/	same-niche competitor whose own copy labels the sector "Gray-market supply · Start in minutes" and states "We're not cheaper than the labs"
https://github.com/tashfeenahmed/freellmapi	free-tier aggregation tier: 34 providers, 635 endpoints, claimed 7.4 bn tokens/month
https://devtoollab.com/blog/omniroute-free-ai-gateway	peer gateway that publishes a ToS table listing 15 providers whose terms prohibit proxy access; also documents that "subscription pooling … violates seat-based licensing"
https://arxiv.org/abs/2607.20860 (IRIS)	black-box auditing of model substitution and routing dilution in LLM gateways — the substitute-backend threat model
arXiv 2606.16100	"Your 'Pro' LLM Subscription May Actually Be 'Free'": fingerprint spoofing risks in LLM inference services
https://github.com/benben951/llm-proxy-auditor	a tool built for exactly this trust question (prompt integrity, model substitution, response rewriting)

Prior internal research (workspace, not vaulted)

Path	What it evidenced
RESEARCH/free-token-gateways/CONSOLIDATED_FINDINGS.md + EVIDENCE_OPERATOR_TRANSCRIPT.md (2026-09-15)	the operator-run version of the same supply: pooled free-tier accounts behind one API, CodeBuddy free-token farming, bulk email + proxies + stealth browser, edu-mail marketplace in the operator's own community; LiteLLM falsified; four separate operations, no shared operator
RESEARCH/inferhub-marketplace/ORCHESTRATOR_INVESTIGATION.md	orchestrator's full pass for this study, 12 sections, evidence-indexed
RESEARCH/inferhub-marketplace/SUPPLY_CHAIN_CODEBUDDY.md	the CodeBuddy free-tier + resale-market chain with the slug-overlap comparison
RESEARCH/inferhub-marketplace/.scratch/EVIDENCE/	raw captures (pages, API JSON, DNS, npm metadata, unpacked helper package, owner-proxy.png) with URL + UTC timestamp provenance