Buying models through a marketplace

A marketplace is what a developer signs up for on a Tuesday afternoon, because it has every model and one bill. That is the whole product, and it is a good one.

Three teams have OpenRouter keys on their expense reports. Where those prompts went, and what the retention is, lands on a platform engineer who set up none of the three. Nobody did.

You buy credits, you get one key, you name any model, and the marketplace forwards the call to a provider it has an account with. You pay the provider’s list price. The marketplace earns on the purchase: a fee when you top up, on some marketplaces a percentage of spend, and an allowance before it charges you for bringing your own provider key. The numbers are in the box at the end, dated, because they move. The shape holds steady. A marketplace is paid when you buy, so it sells choice, and choice is a fine thing to sell.

Where it sits

On the path drawn in the last post, the marketplace occupies the provider’s position. Your client’s connection ends at the marketplace. The marketplace opens its own connection to OpenAI or Anthropic, with its own credential, and the model provider never learns your name. The marketplace holds your prompt in the clear, sets the retention policy for it, and chooses which upstream serves the call.

So its retention page answers where the prompts went, and the record of the call is its own.

Because it holds the connection, it can do all four things from post 3. It decides, since routing is a decision and so is a model allowlist. It meters, since it is the bill. It could redact, and it can log. Some of these it does well. OpenRouter’s stated default is that it does not store prompts or completions unless you opt in, and for a developer with nobody asking, that is the privacy property that matters most. It is a better default than most teams’ own logging.

Custody

A marketplace cannot give you a record you check. Whatever it writes down about what it refused, forwarded or rewrote is kept by the party being checked, and that party is paid on the purchase. This describes the arrangement and is not a complaint about anyone’s conduct. An auditor who accepts “the vendor says so” accepts it about every vendor at once. A request to show what happened needs a record whose custody is on your side of the connection, kept by something that saw the call before the marketplace did.

The same argument returns in post 8 from inside a cloud account, where the record is kept by a party you do not pay on the purchase but whose IAM you do not own either.

The marketplace also decides which of a provider’s regions and accounts serves you, and so which provider’s cache your prompt prefix warms. Marketplaces keep routing sticky for that reason, and some rewrite your cache markers into the form each upstream expects. Post 6 covers what that costs and what it saves.

Who should use one anyway

A developer with nobody asking. One person, one project, the model changes every week, and the value of the marketplace is that switching costs nothing and nobody has to open a second account. There, pistra in front of the marketplace is bureaucracy, and we would not run it either.

The line falls at the first question from outside. The day someone asks where the prompts went, the marketplace’s retention page answers for the marketplace, and the three keys go unanswered.

What pistra does at this box

OpenRouter is one of pistra’s catalog presets. Point a provider at it, put team keys in front, and the keys, budgets, guardrails and the record apply on the way to the marketplace. The marketplace keeps doing what it does. The three keys on expense reports become one credential the marketplace sees and three virtual keys pistra issued, each with a budget, and the record of what was refused and what was redacted is written and signed before the bytes leave your side.

All posts