Sublyte
If you have shopped for cheap Claude or GPT API access, you have seen two kinds of listing that look identical and are not. One sells you a key that talks to the provider. The other sells you a key that talks to *someone's server*, which then talks to the provider.
Both arrive as a string and a base URL. Both work when you test them. The difference only shows up later, which is why it is worth understanding before you pick.
What a reverse proxy actually is
A reverse proxy sits between your code and the provider. You point your SDK at the operator's domain instead of the provider's. They hold the real credentials, forward your request, and pass the response back.
That is not inherently sinister — this is the same shape as a gateway you might run yourself, and declared aggregators like OpenRouter operate openly on this model and are upfront about it. The problem is the undeclared ones, sold as "an API key" with no mention that anything sits in the middle.
Here is what the middle can do, none of which requires malice, only a bad day:
- Read everything you send. Your prompts, your source code, your customers' data. It all passes through their server in plaintext from their side of the TLS connection. Whether any of it is logged is entirely their choice and unverifiable from where you sit.
- Change the model. You ask for Opus, you get something cheaper. Responses still arrive, quality quietly drops, and you will blame your prompt for a week before you suspect the vendor.
- Throttle or queue you. Their capacity is shared across every customer. Your latency is a function of their load, not yours.
- Vanish. The upstream account gets closed, or they stop paying for it, and your integration returns errors with nobody to ask.
None of that is visible in a test call. That is the entire issue: the failure modes are invisible on day one and expensive on day thirty.
How to tell in thirty seconds
Look at the base URL. This is the whole test, and it is conclusive.
| What you were given | What it is |
|---|---|
https://api.anthropic.com | Official Anthropic endpoint |
https://api.openai.com | Official OpenAI endpoint |
| Any other domain | A proxy, a gateway, or an aggregator |
If the base URL is not the provider's own domain, your traffic is going through a third party. It might be a perfectly well-run third party. It is still a third party, and you should be choosing that deliberately rather than discovering it.
Two secondary checks worth a minute:
- Key format. A genuine Anthropic key begins
sk-ant-. Proxies often mint their own format, though some mirror the prefix, so this is a hint rather than proof. The base URL is the proof. - Ask directly. "Is this the official endpoint or a proxy?" An honest operator answers in one word. Evasion is its own answer.
When a proxy is a perfectly reasonable choice
We sell official keys, so read this with that in mind — but the honest position is that proxies are not always the wrong call.
A proxy makes sense when the work is not sensitive and the price gap is large. Summarising public documents, generating throwaway test fixtures, experimenting with prompts, learning an API — if a stranger reading the traffic costs you nothing and the thing dying costs you an afternoon, save the money.
A proxy is the wrong call when the traffic is confidential, the output ships, or something depends on it staying up. Customer data, proprietary code, anything under a contract that says where data may go. There is no price at which routing that through an anonymous server is a good trade.
What a key cannot tell you
One property catches people out regardless of which kind they bought: a normal API key cannot report its own remaining balance.
There is no public endpoint for it. Anthropic's usage and cost reports require Admin API credentials — an Admin key or an org:admin OAuth token — and the Admin API does not work on individual accounts at all. Whatever anyone shows you as "proof of balance" is a screenshot, and a screenshot is not evidence.
So the only real verification is a request. Send the smallest possible call the moment a key arrives, before you build anything on it. If you bought prepaid credit, do this inside whatever support window you were given — ours is one hour from delivery, and it exists precisely because a test call is the only check that means anything.
What we sell, and what we do not promise
Our keys are issued on real Anthropic accounts and the base URL is https://api.anthropic.com. Your SDK runs unchanged; you swap the key and nothing else. Nothing is relayed.
What we do not promise:
- That the key lives forever. The account behind any prepaid key can be closed by the provider at any time, and the balance goes with it. That is true of every seller in this market, including the ones who imply otherwise. Buy what you are about to spend rather than stockpiling.
- Overage beyond the stated balance. Provider billing lags, and under heavy concurrency real usage can overshoot the balance before the account falls into arrears. It happens. It depends entirely on the provider's settlement timing, not on anything we control, so we neither promise it nor refund you for not getting it.
What we do promise is narrow and testable: the key works on arrival. If it does not, tell us within an hour of delivery and it is replaced or refunded.
That is a smaller promise than some listings make. It is the one we can actually keep.