It's a land grab. Right now none of them have a dominant position. Much better to get mind share and market share now. They can always squeeze the value chain later. And whoever wins surely will.

Quite frankly, the proprietary company's products are no longer good enough for them to be able to enforce a moat. The scene is popping and nobody is satisfied staying with one provider. If they stopped selling via Openrouter, the 18.2% of Openrouter's revenue that currently goes to OpenAI or the 23.4% of their revenue that goes to Google would probably dry up. Some people would switch back, but those who are happy to juggle multiple budgets and endpoints and API key management infrastructure are already doing so to avoid Openrouter's 5-10% cut. This is really evident at any $bigco where you can wait for weeks for a purchase order, needing leadership's approval and accounting's "I'll get to it when I get to it."

> OpenAI/Anthropic/etc don’t establish the direct customer relationship.

But they also don't have to pay to support and maintain the direct customer relationship and all the billing, support, liability, etc. The credit card merchant fee (a not insubstantial % at scale) is paid by Openrouter (or Stripe now) and the bill Openrouter pays to OpenAI is transferred probably via wire or something with a lot less fees. Meanwhile if you're paying OpenAI via credit card directly, OpenAI is paying Stripe or whoever.

> And OpenRouter can steer traffic away from those labs over to their own model.

The inverse is also true. If you've deposited money on a Openrouter account, you've taken a very big step across their proprietary moat. Would the proprietary companies rather lose them as a customer forever, or be able to entice them back, which can be done with a single change of a JSON parameter?

> The major labs don’t get personalized data about the user to train on, since it’s aggregated.

(Edit: Looked it up, Openrouter does send a pseudonymous but stable hashed userid upstream, stable across different API keys in the same account [0]. That makes de-identification a lot easier.)

First, a lot of the corporate use is getting ZDRed, so there's nothing to track without going back on zero data retention.

De-identification was trivial for normal web traffic before LLMs. Think of all the crap people's harnesses and claws send without de-identifying. Many coding agents can't help themselves from scanning your home directory.

Sure, the type of person to comment on HN probably has good hygene, but the typical vibe coder doesn't even know what they're leaking.

[0] https://openrouter.ai/docs/cookbook/administration/user-trac...