apis

2 posts with the tag “apis”

Stripe Buys OpenRouter for $7.5 Billion: The Neutral AI Router Just Got Payment Rails

Aug 20, 2026

Christopher Shaun Godwin

Author

On Wednesday, August 19, 2026, Stripe agreed to buy OpenRouter, the AI model marketplace that routes requests across hundreds of models (CNBC). Neither company disclosed the price, but the New York Times reported about $7.5 billion, with $1.5 billion going to the founders and $6 billion to investors (The New York Times). The deal is subject to customary closing conditions, and OpenRouter expects it to close in the coming weeks (Trending Topics).

This matters today because tokens have become the central cost of running AI. The company that routes those tokens now sits on Stripe’s payment rails (Trending Topics). For developers, it means a single wallet and a single routing layer backed by a payments giant.

The deal in numbers

Figure	Value
Reported price	$7.5 billion (undisclosed)
Paid to founders	$1.5 billion
Paid to investors	$6 billion
OpenRouter valuation 3 months ago	$1.3 billion
Annualized revenue in March 2026	near $50 million
Annualized revenue end of 2025	roughly $19 million
Total venture funding	past $150 million

The $7.5 billion price is a report, not a confirmed term. The companies declined to disclose the value (The New York Times).

OpenRouter was valued at $1.3 billion just three months ago. CapitalG led a $113 million Series B in May (SiliconANGLE). Nvidia’s NVentures, Andreessen Horowitz and Menlo Ventures joined the round. Total funding runs past $150 million, and revenue was near $50 million annualized in March (SiliconANGLE).

What OpenRouter actually is

OpenRouter was founded in early 2023 (Trending Topics). It runs an intermediary layer between developers and the growing field of AI models. Customers reach more than 400 models from over 80 providers through one API instead of integrating each vendor separately (Trending Topics).

For each request, the system decides which model to use. It factors in task complexity, price, speed and availability (Trending Topics). A developer holds one account, one API key and one balance. The service can switch to a backup model if the primary endpoint fails, with no integration rewrite (Incrypted).

The scale is what makes the deal consequential. OpenRouter reports it processes more than 10 trillion tokens per day and serves over 10 million developers and companies, including Nvidia, Zoom and Lovable (Trending Topics). Inference volume has grown at least tenfold every year since founding (Trending Topics). The team numbers around 90 people (Trending Topics).

OpenRouter is also a public market signal. Its rankings show which models are being used and how heavily, which makes them one of the few public indicators of provider market share. Recent numbers showed Chinese models gaining in the global token economy (Trending Topics). Many of those open-weight models, from labs like DeepSeek and Z.ai, are popular on OpenRouter specifically because they are non-proprietary and free to run (CNBC).

Why Stripe wants the routing layer

Stripe had already moved toward the AI buyer. It shipped a Token Billing product to bill and manage AI spending (Trending Topics). It has been OpenRouter’s payments provider since at least January, and the two shipped a token billing integration that meters and prices model usage automatically (SiliconANGLE).

Patrick Collison, Stripe’s co-founder and CEO, framed the fit in economic terms. “Tokens are the central currency for companies building with AI, and it’s clear that the real-world economic potential will depend on making good use of scarce compute resources,” he said. “Stripe is building the economic infrastructure for AI, and together with OpenRouter we’ll help businesses maximize profitability by routing their requests intelligently and spending their tokens efficiently” (Trending Topics).

Routers decide which model answers which task, and that decision is where cost meets performance. Balancing the matrix of model choice, task, speed and price in real time is hard as new models appear and prices shift (Trending Topics). A router that also carries the bill sits at the center of that spend.

PitchBook analyst Franco Granda reads the move as deliberate positioning. The acquisition “is Stripe’s deliberate attempt to embed itself into the middle of capital flows in the AI era,” he said (TechCrunch).

The neutrality question

OpenRouter’s value rests on being a neutral third party. Alex Atallah, OpenRouter’s co-founder and CEO, explained the shared outlook. “Stripe has spent over a decade building trusted, neutral infrastructure for businesses, and OpenRouter was built on the same philosophy,” he said. “We believe intelligence will be multi-model. No single model will be optimal for every task, and developers need a neutral layer to orchestrate and manage them all” (Trending Topics).

For existing users, nothing is set to change. Atallah stressed the same name, the same product and the same roadmap, with existing integrations left untouched. Routing decisions will continue to be driven by what is best for users rather than by any model, provider or parent company (Trending Topics).

Andreessen Horowitz, which seeded OpenRouter and co-led its Series A, argues the routing role is foundational. Martin Casado, a general partner there, called tokens “a new, universal medium of value exchange.” He wrote that “the routing becomes the unsung enabler of the whole story, just like payments was” (SiliconANGLE).

The question that hangs over the deal is whether that neutrality survives under a large fintech owner. One of the few independent routing layers between model providers and applications will now belong to a payments group (Trending Topics). With OpenRouter, Stripe is also establishing itself early in AI payments and expense management, an area larger tech players are likely to enter (Payments Dive).

Rules to apply

Route through a neutral layer to cut lock-in. One API key to many models means a bad day at any provider is not an outage (Incrypted).
Watch the neutrality, not the chart. A router owned by a payments giant still promises user-first routing, but that promise is now a contract with a new stakeholder (Trending Topics).
Treat token routing as financial infrastructure. The bill and the route are converging in one layer, and that changes where AI cost sits (Payments Dive).
Use model rankings as a live market signal. OpenRouter’s usage data is a public read on which providers win token share, including the rise of Chinese open-weight models (CNBC).

The bottom line

Stripe paid a reported $7.5 billion for the layer that decides which AI model answers which request (The New York Times). The deal puts routing, billing and payments in one economic stack (SiliconANGLE). The open question is neutrality. Buyers who depend on that neutrality should keep their options open as the integration lands (Trending Topics).

Demystifying API Authentication: From Basic Auth to Bearer Tokens and JWTs

Dec 3, 2025

Christopher Shaun Godwin

Author

When developing an API, authenticating users from the frontend is essential, yet choosing between Basic Auth, Bearer Tokens, and JWTs can feel overwhelming. Select poorly, and you risk either overcomplicating a straightforward app or inviting serious security flaws. This guide breaks down each method—how they operate, ideal use cases, and pitfalls to sidestep—laying the groundwork for sound authentication decisions.

The Authentication Challenge in a Stateless World

Authentication verifies who is making the request, distinct from authorization, which determines what they can access. HTTP’s stateless nature complicates this: each request is independent, like a fresh transaction at a drive-thru. No memory of prior interactions exists, so credentials must be re-proven every time.

Three foundational methods address this:

Basic Auth: The no-frills baseline.
Bearer Tokens: A general-purpose transport layer, often paired with opaque tokens.
JWTs: Compact, self-describing tokens for modern scalability.

Basic Authentication: Simple but Exposed

Basic Auth is the easiest HTTP scheme. Combine username and password with a colon (e.g., user:pass), Base64-encode it, and attach to the Authorization header: Authorization: Basic dXNlcjpwYXNz.

Key caveat: Base64 encoding isn’t encryption—it’s trivial to decode. It’s merely for safe header transmission. Over plain HTTP, credentials broadcast openly. Mandate HTTPS; TLS shields them in transit.

Drawbacks persist even with HTTPS:

Credentials sent per request amplify interception or logging risks (e.g., in proxies or caches).
No built-in revocation or expiration.

Reserve Basic Auth for trusted environments: internal tools, local dev, or controlled machine-to-machine links.

Bearer Tokens: Secure Transport for Opaque Secrets

Bearer Tokens shine as a delivery mechanism, not a token type. The Authorization: Bearer <token> header signals “trust whoever bears this.” The token itself varies—here, opaque (random strings, meaningless without server lookup).

Workflow:

Client submits credentials once.
Server validates, generates/stores random token in DB, returns it.
Subsequent requests flash the token; server queries DB for validity.

Pros:

Avoids repeated passwords.
Easy revocation (delete from DB).
Supports expirations.

Cons:

DB hit per request hampers high-traffic performance.
Horizontal scaling demands shared storage (e.g., Redis).

Opaque Bearers suit simpler apps where lookup overhead is negligible and revocation reigns supreme.

JWTs: Stateless Power with Self-Contained Claims

JSON Web Tokens (JWTs) embed user data directly, slashing server lookups. Structure: three Base64-encoded parts separated by dots—header.payload.signature.

Header: Algorithm (e.g., HS256) and type (JWT).
Payload: Claims like sub (user ID), exp (expiration), iat (issued-at), roles. Standard and custom fields allowed—but only non-sensitive data. Payloads decode publicly (try jwt.io); no secrets here.
Signature: Cryptographic hash of header+payload using a secret key. Tamper-evident: alterations invalidate it.

Verification: Servers recompute signature mathematically—no DB needed. 5-10x faster, scales effortlessly across instances.

Trade-offs:

Statelessness hinders instant revocation. Mitigate with short expirations (e.g., 15-min access tokens), refresh tokens (DB-stored, revocable), or blacklists.
Common pattern: Short-lived JWT access + long-lived refresh rotation.

Algorithms:

HS256 (symmetric): Single shared secret. Good for single-service control.
RS256 (asymmetric): Private key signs, public verifies. Well suited for microservices trusting a central auth authority.

Critical Security Pitfalls to Avoid

HTTPS Everywhere: Unencrypted HTTP exposes all schemes.
Token Storage:

Storage Pros Cons Mitigation
LocalStorage Easy access XSS-vulnerable Avoid for auth tokens
HttpOnly Cookies JS-inaccessible (anti-XSS) CSRF risk SameSite=Strict/Lax
Expirations: Short access (minutes), longer refresh. No year-long JWTs.
Libraries Only: Use well-tested libraries (e.g., jsonwebtoken for Node, PyJWT for Python). Skip DIY crypto.
Algorithm Lockdown: Whitelist expected algos during verification to thwart “none” or key confusion attacks.

Storage	Pros	Cons	Mitigation
LocalStorage	Easy access	XSS-vulnerable	Avoid for auth tokens
HttpOnly Cookies	JS-inaccessible (anti-XSS)	CSRF risk	`SameSite=Strict/Lax`

Choosing Your Method: A Practical Framework

Internal/Low-Scale: Basic Auth + HTTPS.
Public/Simple: Opaque Bearer Tokens—revocation simplicity trumps minor perf hits.
High-Scale/Distributed: JWTs—stateless speed without shared state.

Align complexity to needs: Skip trendy JWTs if sessions suffice.

Quick Recap

Method	Pros	Cons	Best For
Basic Auth	Dead simple	Repeated creds, no revocation	Internal tools
Opaque Bearer	Revocable, no repeated secrets	Per-request DB lookup	Simpler public APIs
JWT Bearer	Stateless, fast, scalable	Harder revocation	High-traffic, distributed

Master these basics, and you’re primed for advanced flows like OAuth 2.0 and SSO in future explorations.