Why Are Cheap Claude & GPT API Keys So Cheap?

Resellers advertise Claude Opus or GPT-5 access at a small fraction of the official per-token price. That gap isn't magic and it isn't (usually) charity — it's an economy built on turning fixed-price subscriptions back into metered APIs. Here's how that supply chain actually works, and what it means for anyone buying a discounted key.

The core trick: a subscription is a fixed cost, an API is a metered cost

Official API pricing is linear: you pay per million tokens, forever. A consumer subscription is different — you pay one flat monthly fee (Claude Pro is $20/mo, Claude Max is $100–$200/mo, ChatGPT Plus is $20/mo, ChatGPT Pro is $200/mo) and get a generous but rate-limited allowance.

If you can wrap a subscription account behind a standard API interface, every token you squeeze out of that flat fee has a marginal cost trending toward zero. Divide one monthly fee across as many tokens as the account will emit before it hits a limit, and the effective per-token price collapses. That is the entire economic engine behind "Opus at 2% of list price." It is arbitrage between two pricing models the vendors never intended to be interchangeable.

The tooling is open-source and popular

This isn't a fringe hack — it's productized. The flagship open-source "subscription-to-API gateway," Wei-Shaw/sub2api, carries roughly 39,000 GitHub stars and advertises unified access to Claude, OpenAI, Gemini and Grok subscriptions with account pooling and cost-sharing built in. The account-pooling front-ends that resellers use to sell the output — songquanpeng/one-api (~36k stars) and QuantumNous/new-api (~46k stars) — are equally mainstream. A whole family of single-vendor proxies exists alongside them, wrapping Claude Code, GitHub Copilot, AWS Kiro, Amazon Q and the Gemini CLI's free allowances into OpenAI-compatible endpoints.

Mechanically there are two families. One authenticates with a subscription's OAuth token and impersonates the official client (Claude Code, the Codex CLI) to reach the real vendor backend — so the model you get really is the genuine model, just sourced from a pooled subscription rather than a metered API key. The other replays the web app's internal endpoints using captured session cookies; that path is older, more fragile, and more prone to missing features.

Where "official price × 2%" actually comes from

The cheapest tiers usually trace to one of three sources:

Free allowances, pooled at scale. AWS Kiro, the Gemini CLI / Code Assist, and GitHub Copilot's education plan all hand out free or near-free model access. Upstream cost is approximately zero, so the floor price is set only by servers and account churn. Much of the "2% of list" supply is free-allowance accounts multiplied across many users.
High-tier subscriptions, sliced thin. A $200/mo Max or Pro plan spread across many concurrent users lowers each user's share far below metered API pricing — at the cost of shared rate limits everyone contends for at peak.
Downgrade and dilution. Some of the gap is not real savings at all: a request billed as Opus can be silently routed to a cheaper model, a 200K context quietly capped, or tools and vision disabled. This is where a discounted key stops being a bargain and starts being a different product than advertised — which is exactly what a verification test is for.

What you actually take on when you buy the cheap tier

None of this means a cheap key won't work. It means the failure modes are different from a direct vendor relationship, and they're predictable:

Jagged availability. Reverse-engineered supply is inherently fragile. When a vendor tightens its client checks or ends a free-allowance promotion, whole channels can go dark at once. A provider's long-term uptime curve tends to look like a saw blade rather than a flat line.
Rate-limit contention. Pooled accounts stack a second layer of throttling on top of the subscription's own limits, so peak-hour 429s and time-to-first-token spikes are common.
Feature gaps. Extended thinking, tool calls, prompt caching and full-length context are the first things to break or be silently downgraded on reverse-engineered paths.
Policy risk upstream. This one is documented: through 2026, Anthropic moved against third-party use of subscription OAuth tokens — new client-restriction errors appeared in January, the terms were updated in February to prohibit it explicitly, and enforcement landed in April. Whenever a vendor tightens the rules, the channels sourced that way can break with no notice.

Does a signature check prove a key is "real"?

Partly. Anthropic's extended thinking returns a server-side cryptographic thinking_signature that web-scraping or fake-protocol endpoints can't forge — so a signature check is a strong filter against outright model substitution and pure web reverse-proxies. But it has a blind spot worth understanding: an OAuth-based subscription proxy talks to the genuine Anthropic backend, so it returns a valid signature too. A signature check tells you "this is really Claude," not "this came from an official metered API." Telling those two apart takes behavioral signals — hidden-injection token counts, rate-limit variance, and that saw-blade uptime history — not a single cryptographic check.

How to shop the cheap tier without getting surprised

Verify before you build. Run our free browser-based verifier the moment you get a key — it checks reachability, model identity and response fingerprint, and your key never leaves your browser.
Read the refund terms first. Reverse-engineered supply breaks; several of the resellers we track publish absolute no-refund clauses. See the refund-policy comparison before you prepay.
Prepay only what you can afford to lose, and treat a suspiciously low Opus or GPT-5 price as a reason to test, not a reason to trust.

The Series

Three follow-up explainers dig into one part of this supply chain each, with dated, linked sources:

The Economics of Reselling a $200 Claude Max Seat — the subscription-to-API math, source by source.
Why Reverse-Engineered Channels Die in Waves — the 2026 enforcement timeline, and why supply is structurally jagged.
Why a Signature Check Can't Tell Official From Subscription-Reversed — what our verifier, and any signature check, can and can't prove.

FAQ

Is a cheap reverse-engineered API key against the rules?

Using a subscription's OAuth token or a web session through a third-party gateway generally violates the vendor's terms of service, and vendors have enforced against it — Anthropic restricted third-party use of subscription tokens across 2026, for example. That's a risk borne by whoever operates the channel, but it's why these channels can break without notice. We're describing the economics, not giving legal advice.

Will a cheap key give me the real Opus or GPT-5?

Sometimes yes: an OAuth-based subscription proxy reaches the genuine vendor backend, so the model really is the advertised one. Sometimes no: a request billed as a top model can be silently routed to a cheaper one. The only way to know for a given key is to test it — our browser-based verifier checks model identity in about 15 seconds.

Why do the very cheapest sources keep disappearing?

Much of the lowest-priced supply comes from free allowances (AWS Kiro, the Gemini CLI, Copilot education plans) or from subscription tokens the vendor hasn't yet restricted. When a promotion ends or a vendor tightens its client checks, that supply vanishes — which is why a provider's uptime history is one of the most telling things you can look at.

Is Sub2API itself doing something wrong?

Sub2API is an open-source project (roughly 39,000 GitHub stars) that its own README frames as being for technical study and used at your own risk, noting it may violate upstream terms of service. The tool is neutral infrastructure; how any given reseller uses it — and whether they deliver what they advertise — is a separate question you can test yourself.

This page explains a supply chain in general terms using publicly verifiable facts — open-source project popularity, official subscription prices, and the documented 2026 policy changes. It does not accuse any specific reseller of anything; where we assess an individual provider we do it from its own published pages and our own dated tests. See our methodology.