API keys are risky to buy. They can be revoked, shared or stolen, and most providers forbid selling them. If you buy one anyway, this is how to limit the damage.
Types of API access sold
- Prepaid credits on a service such as OpenAI, Google Cloud or AWS
- Custom API endpoints, where the seller runs a service and sells access to it
- Reseller keys offering bulk access at a discount
- Google, AWS or Azure service accounts that come with credits
The main risks
- The original owner can revoke the key at any time. You pay, they revoke it, and you have nothing.
- Cheap keys are often stolen. Using a stolen key is illegal and can get your own accounts banned.
- If several people share the key, you'll hit rate limits and the provider may disable it.
- Providers forbid it. OpenAI's terms, for example, ban buying, selling or transferring API keys, and other providers have similar rules.
What to check
Before you confirm receipt:
- Test the key with real API calls
- Check the remaining balance or credits
- Check that the rate limits match the listing
- If you got access to the account itself, generate a new key so the seller's copy stops working
- Check for IP restrictions
Using escrow
Escrow matters more than usual here. In an escrow deal:
- You receive the key in the deal chat
- You test it with real API calls
- You check the balance or credits
- You confirm only when it works as described
If the key is revoked, broken or short on balance, open a dispute before you confirm. Escrow ends when you confirm, so a key revoked a week later isn't covered.
Safer alternatives
Instead of buying keys, consider:
- Buying credits directly from the provider. It costs more, but no seller can revoke them.
- Paying for a hosted service that runs on the seller's own account and endpoint.
Buying a whole account carries the same risks as buying a key: the original owner can usually recover it, and most providers forbid transfers.
A warning about provider rules
Many providers forbid sharing keys, and buying one could get every connected account banned. Read the provider's terms first.
EPICSWP's escrow protects the payment between you and the seller. It doesn't make a key sale allowed under the provider's terms, and it can't stop the provider revoking the key. Any key you buy is at your own risk.