Relays sell frontier models below list price because they rarely pay list price. The platform whose accounts, free credits and API keys fill the relay's pool pays the difference.
GuideHarry Johnston, NoResponse12 min read
An API relay resells another company's AI models through its own API, and most of the tokens it sells come from accounts and API keys on the platform it resells. This is inference abuse: the relay captures the margin while your platform pays for the compute. The Chinese market calls it a transfer station, 中转站, and developers also say LLM proxy. A relay is any site or endpoint that sells unauthorised access to someone else's models. Most resell cut-price subscription access as an API.
We wrote this guide for the lab, host or router whose tokens a relay sells. On 8 September 2026 CISA, the NSA and the FBI put the term into a joint advisory, warning that "China-based AI companies use a gray market of proxies known as 'transfer stations'". Our guide to token fraud shows where relays sit among the other kinds of abuse.
At a glance
A relay holds a pool of accounts and API keys on your platform and puts them behind keys of its own. Its customers send requests to the relay, and the relay forwards each one through a credential from the pool.
Team Cymru describes the pool as "API keys, or logged-in consumer subscription sessions", which the relay re-exposes "behind keys of its own". The buyer tops up a balance, receives a key and a base URL, and points a coding agent or app at the relay. One relay described the routing in its own advertising, reproduced by Okta Threat Intelligence:
"We add those accounts to our pool, your request is routed to a specific account under the hood (you don't see this) and you get charged 5-15% of the official per-token price depending on the model."
The software is free and well documented. General gateways such as new-api route traffic across many providers and have honest self-hosted users. CISPA's audit of shadow APIs found 11 of the 17 it traced built on OneAPI or its derivative, NewAPI. A second family exists to turn consumer subscriptions into an API.
| Software | What its GitHub page says it does | Created |
|---|---|---|
| new-api | "A unified AI model hub" for aggregating and distributing models | November 2023 |
| CLIProxyAPI | Wraps ChatGPT Codex, Claude Code and other coding tools as an OpenAI, Gemini, Claude or Codex compatible API service | July 2025 |
| sub2api | A one-stop open-source relay service that puts Claude, OpenAI, Gemini and Grok subscriptions behind one access point, with shared "carpool" plans | December 2025 |
All three projects had more than 40,000 GitHub stars by October 2026. Stars measure interest, so they say nothing about how many relays run each package.
A relay's tokens come from five places, and four of them are accounts or keys on the platform it resells. Each route leaves a different trace in your own data, so it pays to know which one you are looking at.
Team Cymru's reading of sub2api's own sponsor list points the same way. Of 26 commercial sponsors, it counted 15 API relay resellers, 7 residential proxy vendors and 2 sellers of model accounts. It says those two obtain their credentials "through illicit means, such as exploiting promotional offers and possible credential/token theft."
A relay consumes your compute and pays you little or nothing for it. It also hides its customers from you, so your controls judge one account when the traffic belongs to dozens.
The compute is the obvious loss. In July 2026 OpenCode said it had banned one operator running 8,000 accounts that resold $480,000 of tokens a month. When the cards behind those accounts are stolen, chargebacks follow.
The hidden customers cost more over time. Team Cymru says providers rely on "account attribution, usage metering, and behavioural controls", and that relays weaken all three "by separating the apparent requestor from the party actually consuming the service." Your logs show the relay's server and its credential. In Team Cymru's words, the provider "never sees the actual source IP of the user." Region rules, rate limits and bans all act on the wrong party.
The customers you can't see include ones you would never serve. Anthropic's September report describes one account that was "a reseller relay serving more than a dozen unrelated customers". In the same report Anthropic says it banned one operation's accounts and helped take down the relays it used to get round regional blocks. The operator "re-established access within days".
Nobody has measured the market's revenue, but the visible slices are large. The best count so far is Team Cymru's, with 10,867 servers in one eight-day scan and more than 80,000 relays since, by its own account.
Team Cymru found the 10,867 servers by the banners that Claude Relay Service and its successor sub2api return to a scan, across 457 networks. In a note added to the post, it says that "Since this analysis was conducted, Team Cymru has discovered more than 80,000 relays, as compared to the initial list of ~10,000." The post does not say how it counted the larger figure, so treat it as the vendor's claim.
Relays also resell each other. A 2026 study of prefix-cache side channels sent 1.1 million requests across 636 pairs of reseller endpoints. In 37.1% of pairs, both endpoints reached the same upstream prompt cache, and the dependencies ran up to seven layers deep. The authors caution that a shared cache is a sign of shared supply, not proof of a contract. For a platform, it means one pool of your accounts can feed many storefronts.
Most buyers want a frontier model that their region, budget or terms of use keep from them. The rest want large volumes of output, which can mean training another model.
From your side, a relay is an account or key that behaves like many customers at once. The signs are more sessions, networks, client types and kinds of work than one customer would produce, and use that starts at full speed.
The US advisory lists the warning signs it wants AI companies to watch, including "shared accounts from multiple IPs/user agents" and "consistent operational patterns across diverse account pools". Team Cymru's finding adds a second pattern. Where a relay runs on its own servers, many of your accounts converge on a few hosting addresses, because the relay's servers send every request.
The token resale guide sets out how to detect this in your own logs: the usage signals, the request headers that gateway software sets, how to tell a heavy user from a reseller and how to confirm a suspicion before acting.
Take down the whole pool at once, then watch for its replacement. Banning accounts one at a time lets the relay move its traffic to the rest of the pool and keep selling.
A relay that pays your list price can't sell your tokens at 70% off for long. The size of the discount tells you which of the five supply routes it relies on.
| Source | What was measured | Price against official list |
|---|---|---|
| ChinaTalk, May 2026 | Chinese sellers of Claude tokens, as one reporter described them | "1 RMB per $1 of tokens", which the piece puts at 70 to 90% below official prices |
| Okta, August 2026 | One relay's own advertising | 5 to 15% of the official per-token price |
| AI Ping, Q4 2025 | Authorised hosts of popular open-weight models, for contrast | Most within 5% of official |
Authorised hosts cluster near list price, so a relay selling at 70 to 90% below list pays far less than list for what it sells. That price fits accounts paid for with stolen cards, free credits claimed in bulk, leaked keys and shared subscriptions, where someone other than the relay pays. ChinaTalk's reporter names the same sources: accounts registered in bulk, quota resold from other people's accounts and "accounts purchased using stolen or fraudulent credit cards".
A smaller discount points elsewhere. CISPA found price told buyers nothing about which model came back, so a relay charging near list price may be serving a cheaper model. Each price you see for your models on a relay is evidence about how it gets your tokens.
Every measured sample so far came from the Chinese-language market. The English-language market is less studied, but it shows the same signs. OpenCode's operator ran accounts behind rotating proxies, and Tibo, who works on Codex at OpenAI, said in August 2026 that many Codex users with unusual limits were running sub2api. A future market report will size both the Chinese-language and English-language relay markets.
Yes. Buyers risk getting a different model, an operator nobody can trace and no refund when the service closes.
CISPA found model identity failures in 45.83% of its fingerprint tests, 15 of the 17 operators had no transparent identity, and 4 had closed by the time it published, taking prepaid balances with them. Anthropic advises buyers that "An alleged discount that requires routing traffic and credentials through an unknown intermediary introduces tremendous risk to user data and systems." For a platform, the buyer's risk becomes yours when a relay serves another model under your name.
Start with data you already hold. Add external relay listings only after your internal signals identify the accounts and keys worth tracing.
Relay intelligence answers the question this guide ends on. It shows which relays sell your tokens, at what price, and which of your accounts and API keys supply them. We track 70+ relay and resale services and the places they advertise and sell. Every relay we report comes with its evidence: the listing, the price and when we saw it.
On your platform, usage fingerprints learn how each account uses it, link accounts that behave alike and spot keys that start acting like a pool. Fingerprints use account and request-pattern signals in your gateway to identify repeat abuse. NoResponse does not make content-safety decisions. The sign-up check looks up a new user's email, username or phone number on about 4,000 sites before the account's first request. That is where you can turn away accounts opened under false details, before they join a pool. If a relay is draining your platform now, incident support helps your team close the pool in one wave.
Book a demo to see which relays list your models today and what they charge.
Every token an AI platform serves runs on compute someone pays for. Token fraud is when the person using it is not the person you sold it to. This guide maps the four ways that happens and links to a guide for each.
GuideA resold account looks like one customer and behaves like a hundred. This guide sets out the signals in your own logs that give it away, how to confirm resale without hurting real customers, and what to do once you find it.
GuideYour customers' leaked keys end up in resale pools, and the traffic arrives under accounts you have every reason to trust. A platform can find many leaks first, notice when a key changes hands and cap what a stolen key can spend.
GuideEvery free credit on an AI platform is compute someone pays for. Score each sign-up before it gets credits, stage the credits and keep the card for accounts that raise a signal.
Guide中转站 means "transfer station". In the Chinese AI market it names a service that resells access to foreign AI models through its own API. English sources adopted the translation in 2026, including the September advisory from CISA, the NSA and the FBI and Team Cymru's scan of relay servers.
Because most relays don't pay list price for the tokens they sell. The sources describe accounts opened with false identities and stolen cards, free sign-up credits, shared subscriptions, leaked API keys and cheaper models served under a dearer name. Authorised hosts mostly price within 5% of the official rate.
No. An authorised router has an agreement with the labs whose models it sells and prices close to the official rate. A relay resells access it has no right to resell, usually at a deep discount, and often runs on the same open-source gateway software that legitimate teams host for themselves.
Not under the labs' terms. Anthropic says Pro and Max limits assume ordinary individual use and bars routing requests through those plans on behalf of other users. A member of OpenAI's Codex team said in August 2026 that OpenAI's fraud systems flag subscriptions converted into API traffic for many users.
Look from both ends. On your platform, look for accounts and keys that behave like many customers, share payment details or send traffic from the same hosting addresses. Outside it, search relay storefronts for your model names and prices, and match what you find against the accounts you flagged.
