A resold account looks like one customer and behaves like a hundred. This guide sets out the signals in your own logs that give it away, how to confirm resale without hurting real customers, and what to do once you find it.
GuideHarry Johnston, NoResponse11 min read
AI inference abuse prevention starts by finding accounts and API keys that behave like many unrelated customers behind one login. The signals sit in logs you already keep: parallel sessions, network and device reuse, gateway software in request headers, unrelated prompt patterns and payments that turn into refunds after the tokens are spent. Combine behavioural fingerprinting with device intelligence and account-link analysis before you decide whether to block, verify or review an account.
Resale is the step where abuse turns into a business. An operation opens or buys accounts, puts them behind one endpoint and sells the tokens to its own customers at a discount. Anthropic described one such account in its September 2026 threat report: "It was not a single user: it was a reseller relay serving more than a dozen unrelated customers, which exchanged over tens of thousands messages with Claude in a matter of days." This guide covers how that looks from the provider's side and what to do about it.
At a glance
A resold account appears as one customer in your records but serves many unrelated people. It may pay once, or not at all, while requests that should belong to separate customers arrive through one account or key.
Okta Threat Intelligence gave the clearest public example. A relay it calls Poison Claude sold cheap access to Anthropic models by pooling accounts opened for cloud bonus credits, and a mistake in its setup showed nearly 900 active users on the service. Okta's technical write-up quotes the relay's own pitch, which tells buyers that each request goes "to a specific account under the hood". To the cloud provider, each of those accounts was a customer.
WorkOS, which sells sign-up protection, describes a second pattern in its guide to LLM token theft. An operator clears a new account's checks, then sells it on, "and one verified account ends up serving far more users than it was ever licensed for". Account sharing on a flat-rate plan works the same way. A plan priced for one person becomes an API for a team or a paying crowd.
Resold tokens come from accounts and API keys that someone else paid for, or never paid for at all. Each source leaves a different trace, so it helps to know which one you are looking at.
No single signal proves resale, but resold accounts tend to break several of your normal patterns at once. Score each account against its own plan and product, and act on the combination.
| Signal | What resale tends to look like | Where the idea comes from |
|---|---|---|
| Concurrency | More parallel sessions or streams than one person or one team's tools would open | Our advice, from the pattern in the Okta and CISPA cases |
| IP and ASN spread | Requests from many networks and countries in one day, often through VPNs or residential proxies | Okta |
| Client fingerprints | Request headers set by gateway software instead of your own client or SDK | The one-api and new-api source code |
| Prompt mix | Work unrelated to your product, many writing styles and languages, coding jobs in a support bot | WorkOS |
| Output-to-input ratio | A ratio far from your normal customers, in either direction | WorkOS and Team Cymru |
| Registration to first token | Heavy use within minutes of sign-up, at the plan's limit from day one | The US advisory |
| Model choice | The most expensive models only, and a fast move to each new release | Anthropic |
| Payment and refunds | Shared cards across accounts, prepaid or virtual cards, refunds and chargebacks after heavy use | Anthropic and Stripe |
We don't publish thresholds, because they depend on your plans and your customers and they stop working once operators read them.
Client fingerprints. Most relays run on open-source gateways. CISPA's audit of shadow APIs, accepted at ACM CCS 2026, found 11 of 17 built on OneAPI or its derivative NewAPI. The gateways leave marks in their code. one-api's Anthropic adaptor sends a fixed anthropic-beta: messages-2023-12-15 header and falls back to the 2023-06-01 API version. It sets no user agent there, so its requests carry the Go standard library's default, which Go's source defines as Go-http-client/1.1. new-api sends HTTP-Referer: https://www.newapi.ai and X-OpenRouter-Title: New API on requests to OpenRouter unless the client sets its own.
Gateways also copy official clients. new-api's Codex channel takes a ChatGPT sign-in token as its key and adds originator: codex_cli_rs when the caller sends none, so its requests claim to come from OpenAI's own command-line tool. A header tells you which software sent a request. It can't tell you whether the account owner is reselling, so treat it as one signal among several.
Output-to-input ratios. WorkOS says abusive traffic "can also carry abnormally high output-to-input token ratios". Team Cymru saw the opposite at transfer stations talking to Anthropic, which uploaded about 58 bytes for every byte they downloaded. Both findings fit the same advice. Learn the ratio your real customers produce, then look at accounts far outside it.
Registration to first token. The US advisory tells AI companies to watch for new subscriptions at maximum usage from the start, round-the-clock use with no idle periods, and "anomalous subscription-to-API usage ratios".
Model choice. Resellers sell the models their buyers want, which are usually your newest and most expensive. Anthropic said in February 2026 that one operation "pivoted within 24 hours" of a model release, moving nearly half its traffic to the new model.
A heavy user is one person or one team with one rhythm, one set of tools and one kind of work. A reseller is many customers at once, so its traffic has many rhythms, many tools and many kinds of work on the same key.
Your terms decide where sharing stops. Anthropic's Claude Code legal page says Pro and Max limits assume "ordinary, individual usage" and bars developers from routing requests through those plans for their own users. Tibo, who works on Codex at OpenAI, wrote in August 2026 that turning a subscription into API traffic for many users "gets flagged by our fraud-prevention systems", while signing in through official or open-source clients is fine. Write your own line down before you enforce it.
Confirm resale in four steps: watch, group, step up and check the market. Each step should add evidence, and none should cost a real customer more than a short check.
Keep a record of each step, because it is your evidence if the customer disputes the decision.
Cut off the supply in one move, then watch for the operation's next accounts. Banning accounts one at a time lets the operation move its traffic and keep selling.
The common mistake is acting on one signal and hitting real customers with it. The other is acting so slowly that the operation has already moved on.
OpenAI shows the first risk. Between 26 and 29 June 2026 its status page ran an incident, "Codex Usage Limits Depleting Faster Than Expected", and traced it to its abuse and fraud systems "incorrectly rate limiting certain accounts". Our Codex subscription resale case covers what OpenAI said next. Blanket limits carry the same cost. Our Anthropic weekly limits case shows how resale by a few subscribers led to new limits for every Pro and Max user.
Start with the logs you already hold. Add the signals to your review queue, then tune the decision after you have observed real customers.
anthropic-beta: messages-2023-12-15 and a Go-http-client user agent. If you run a model router, also look for HTTP-Referer: https://www.newapi.ai and X-Title: One API. Then list requests that name your official client but differ from it in every other header.We built NoResponse to find token resale from both ends: the accounts on your platform and the relays that sell your tokens.
The token fraud guide shows where resale sits among the other kinds of abuse. To see which relays sell your tokens today, book a demo.
Every token an AI platform serves runs on compute someone pays for. Token fraud is when the person using it is not the person you sold it to. This guide maps the four ways that happens and links to a guide for each.
GuideTwo public statements from OpenAI in 2026 show both sides of enforcement against subscription resale. One warned people running sub2api. The other was an incident report for Codex users the same systems caught by mistake.
CaseA flat-rate plan priced for one person becomes cheap token supply when it is shared. Anthropic answered in 2025 with a weekly cap on Pro and Max subscribers, and software that shares subscriptions as an API appeared five months later.
CaseEvery free credit on an AI platform is compute someone pays for. Score each sign-up before it gets credits, stage the credits and keep the card for accounts that raise a signal.
GuideRelays sell frontier models below list price because they rarely pay list price. The platform whose accounts, free credits and API keys fill the relay's pool pays the difference.
GuideIt depends on the platform's terms. Anthropic says its Pro and Max limits assume ordinary individual use and bars routing those plans for other people, and OpenAI says it doesn't support turning a ChatGPT plan into API traffic for many users.
It is turning a flat-rate plan meant for one person into an API that other people pay to use. Open-source tools such as sub2api and new-api's Codex channel do it by putting a subscription's sign-in token behind a gateway.
No. Both are open-source gateways with legitimate self-hosted users, so their headers show which software sent a request and nothing more. Treat them as one signal and look for concurrency, network spread and unrelated prompts on the same account.
Search for your product and model names on relay storefronts and price lists, then match their models, prices and dates against your flagged accounts. A relay intelligence service does this continuously and links each listing to the accounts and keys that supply it.