/credential-pooling-analysis

name: credential-pooling-analysis
description: Analyze credential pooling operations and API reseller business models — economics, risks, detection patterns, and sustainability
tags: [business-analysis, api-reseller, credential-pooling, arbitrage, economics]
related_skills: [web-scraping, cloud-browser-automation]
origin: unknown
source_license: see upstream
language: en

Credential Pooling Analysis

Framework for analyzing API reseller operations that use credential pooling (bulk account creation → free tier exploitation → resell access at markup).

What is Credential Pooling?

**Definition**: Acquiring many free/trial accounts from a service, pooling their credits/quotas, and reselling access to end-users at a markup.

**Common pattern**:

User → Reseller API → Credential Pool (100s of accounts) → Official API (Claude/GPT/etc)

**Economics**:

• Input: Bulk accounts (e.g., 100 Google accounts = $1-2)
• Multiplier: Each account gets $5-10 free credits
• Output: $500-1000 total credits
• Markup: Sell at 50-70% of official API price
• ROI: 50-100x return on account cost

Analysis Framework

1. Identify the Operation

**Signals that indicate credential pooling**:

✅ **Pricing signals**:

• Significantly cheaper than official API (30-70% discount)
• Credit-based, not subscription
• "No subscription, just credits" messaging
• Prices that don't match any official tier

✅ **Technical signals**:

• Unified API for multiple providers (Claude + GPT + Gemini in one endpoint)
• OpenAI-compatible API (drop-in replacement)
• Frequent "maintenance" or "rate limit" messages
• Inconsistent response times

✅ **Business signals**:

• New/small operation (not official partner)
• Located in regions with cheap bulk accounts (Indonesia, India, etc)
• Telegram/Discord-only support (no official business presence)
• Vague about "how we get access"

2. Scrape and Extract Data

**Target pages**:

• Homepage (tagline, value prop)
• Pricing page (model list, credit costs)
• Docs (API endpoints, authentication)
• About/Contact (location, team, legitimacy signals)

**Use escalation ladder** (see `cloud-browser-automation` skill): 1. Try `web_fetch` first 2. Try direct curl with headers 3. Try Hermes browser 4. Use Browserbase if Cloudflare-protected

**Key data to extract**:

{
  "site": "example.com",
  "tagline": "...",
  "models": ["claude-opus-4", "gpt-5", ...],
  "pricing": {"claude-opus-4": "$X per 1M tokens"},
  "features": ["streaming", "openai-compatible", ...],
  "contact": {"email": "...", "discord": "...", "telegram": "..."},
  "location": "...",
  "legal_docs": ["terms", "privacy", ...]
}

3. Economic Analysis

**Calculate unit economics**:

# Input costs
accounts_cost = 100 * 0.02  # $2 for 100 Google accounts
credits_per_account = 7.5   # $7.50 average free credits
total_credits = 100 * credits_per_account  # $750

# Output revenue
markup = 0.5  # 50% of official price
official_price = 1.0
reseller_price = official_price * markup
revenue = total_credits / reseller_price  # How much they can sell

# Profit
profit = revenue - accounts_cost
roi = profit / accounts_cost

**Key metrics**:

• **ROI**: Return on investment (target: 20-100x)
• **Burn rate**: How fast credits deplete
• **Ban rate**: % of accounts that get banned
• **Sustainability**: Can they maintain supply?

4. Risk Assessment

**Operational risks**:

| Risk | Impact | Likelihood | Mitigation | |------|--------|------------|------------| | High ban rate | Service disruption | High (30-60%) | Diversify providers | | Provider closes loophole | Business death | Medium | Have backup sources | | Legal action | Shutdown | Low (hard to enforce) | Offshore entity | | Detection patterns | Account bans | High | Rotate IPs, randomize usage | | Credit exhaustion | Revenue loss | High | Continuous account creation |

**Provider-specific ban rates** (from user's data):

• **Kiro**: 58% ban rate (AWS actively blocks third-party harness)
• **CodeBuddy**: 0% ban rate (Tencent detection weak)
• **Cursor**: Unknown (not tested)

**Detection signals providers look for**:

• Same IP for many accounts
• Identical usage patterns
• Rapid sequential requests
• Unusual geographic distribution
• API key sharing patterns

5. Sustainability Analysis

**Short-term (0-6 months)**:

• ✅ Highly profitable (ROI 50-100x)
• ✅ Easy to scale (bulk accounts cheap)
• ⚠️ High churn (ban rate 30-60%)

**Medium-term (6-18 months)**:

• ⚠️ Provider detection improves
• ⚠️ Free tiers get restricted
• ⚠️ Competition increases (price war)

**Long-term (18+ months)**:

• ❌ Unsustainable (providers close loopholes)
• ❌ Legal risk increases
• ❌ Need to pivot to legitimate model

6. Competitive Analysis

**Compare multiple operations**:

| Operator | Models | Pricing | Location | Stage | Risk Level |
|----------|--------|---------|----------|-------|------------|
| adye.dev | 7 models | 50% off | Unknown | Operational | High |
| enowxlabs.com | Unknown | Unknown | Indonesia | Beta | Medium |

**Differentiation strategies**:

• **Price**: Race to bottom (unsustainable)
• **Reliability**: Better uptime (requires more accounts)
• **Features**: Better API, docs, support
• **Niche**: Specific models or use cases

Common Patterns

Pattern 1: Pure API Reseller (adye.dev style)

**Characteristics**:

• Direct API proxy
• Multiple models in one endpoint
• Credit-based pricing
• Minimal branding

**Pros**:

• Simple to build
• Fast to market
• High margins

**Cons**:

• Commodity (easy to copy)
• High ban risk
• No moat

Pattern 2: Software Marketplace (enowxlabs.com style)

**Characteristics**:

• Platform for developer tools
• Built-in licensing system
• API access as backend
• More legitimate appearance

**Pros**:

• Better optics (not just reseller)
• Multiple revenue streams
• Harder to shut down

**Cons**:

• More complex to build
• Slower to market
• Still relies on pooling

Pattern 3: Hybrid Model

**Character