Complaints that English-speaking developers posted publicly around Nov 5–6, 2026, paraphrased below with links to the original posts. It was a relatively light day for mass API outages — the loudest pain was key theft, usage walls, pricing cliffs, and video credit burn. Each answer uses only what PoYo's public site and docs say today, and links to the page it comes from. Where the docs don't cover something, we say so.

Q1. Stolen / leaked AI API keys — surprise bills (LLMjacking).

What developers are complaining about: After host-platform breaches and leaked secrets, builders are still getting unauthorized model spend before they notice. One Railway-related post reported ~$30 of usage after a compromised key (@heyjibril); another suspected an xAI key was taken in the same Oct 21 Railway incident (@mateusztylec). A Railway Station thread described an OpenRouter key spike of about $28 in hours (station.railway.com). Security posts framed the pattern as LLMjacking — stolen cloud keys that can rack up large bills in a day (@dd_pwnd).

How PoYo answers: Treat the key as a secret, then use the documented controls that limit blast radius (Getting Started):

1. On the API key page, set hourly / daily / total usage caps so a leaked key cannot keep spending past the ceiling.
2. Enable an IP allowlist so only approved server IPs can call the API (Getting Started).
3. For multi-tenant apps, send X-End-User-ID and block one caller without rotating the whole key (end-user identification).
4. Poll GET /api/user/balance and treat 402 insufficient_credits_error as a hard stop (user balance, error codes).
5. Never put keys in frontend / public repos (Getting Started).

Billing is prepaid credits drawn per successful output; failed generation tasks are not charged (homepage, llms.txt). Public docs do not promise automatic refunds for stolen-key spend, intrusion alerts, or a published chargeback SLA — if you need account help, use dashboard support / [email protected] (Getting Started).

Q2. Same 429 for rate limits and “out of money.”

What developers are complaining about: Guides still have to explain that provider 429 responses can mean RPM/TPM throttling or exhausted credits / spend caps — so blind retries on a billing case just waste time (Respan, Nov 5, OpenAI help). Builders talking about AI token spend keep asking for clearer quotas and 429 handling (@PeterOmogo2).

How PoYo answers: PoYo separates those cases in the documented business codes (error codes):

Generation defaults: up to 20 new /api/generate/submit requests per 10 seconds per account; overage returns 429 and does not enter the queue. LLM endpoints are currently not rate limited (Getting Started). Check GET /api/user/balance before large batches (user balance). Cap keys on the API key page. Prefer webhooks for long media jobs so a 429/5xx blip does not become a poll storm.

Docs do not claim OpenAI-style “credit_balance_exhausted inside a 429 body” — on PoYo, empty balance is 402.

Q3. Claude Code usage walls + status-token bleed.

What developers are complaining about: Claude Code users hit usage ceilings mid-task; Wrap-Up Allowance is framed as a response to hard cutoffs (@markvalorian). “99% cheaper status updates” messaging is read against sessions that still burn a meaningful slice of the limit (@rafke_rafke0311). Others say background agents spend money just to post status (@BoboLinNotes), and workarounds circulate for the 5-hour wall (@kel_ruael).

How PoYo answers: PoYo does not sell a Claude Code / Max-style timed usage window mixed with overage. Chat and media share prepaid credits from one wallet; empty balance returns 402, not a surprise weekly burn invoice (homepage, error codes).

Practical pattern matching what those posts want:

• Set per-key hourly / daily / total caps so a heavy coding day cannot silently keep spending (API key page).
• Check GET /api/user/balance before large agent batches (user balance).
• Pick an explicit chat model ID and read live pricing at https://poyo.ai/models/<id>/llms.txt — some cards publish rates ~20% below official standard (for example Claude Opus 5.5, Claude Sonnet 5.5); that is per-card, not a blanket discount.
• Use OpenAI-compatible /v1/chat/completions, Claude Messages /v1/messages, or Gemini-native endpoints as documented (API overview, chat overview).

Public docs do not claim a Wrap-Up Allowance product, a 5-hour session wall, or automatic “status updates are 99% cheaper” accounting — build cheaper status / fallback model logic in your client.

Q4. Auth looks banned — stale API key overrides a working login.

What developers are complaining about: Claude Code can log in successfully then still throw 400 organization disabled, because a leftover API key environment variable overrides OAuth — it looks like a ban, and is often a key conflict (@lgs1520).

How PoYo answers: PoYo auth is simpler and explicit: send Authorization: Bearer <API_KEY> (or x-api-key on /v1/messages). Missing/invalid keys return 401 authentication_error (Getting Started, error codes). Create and rotate keys on the API key page; pair rotation with IP allowlist and usage caps if a key may have leaked.

Unknown or wrong model IDs / unsupported URI shapes return documented 400/404 LLM errors — not an “org disabled” subscription state (error codes, chat overview).

Docs do not describe Claude Code OAuth-vs-key override behavior, organization-disabled subscription states, or a consumer login that silently fights a shell ANTHROPIC_API_KEY. Keep one intentional auth path in your tooling.

Q5. Pro / Business API credit grants that never show up.

What developers are complaining about: Eligible ChatGPT Pro / Business users say monthly API credit grants ($100–$500 class) are missing or hard to claim (@FanShiFanSI, @hu_victoria071). Separately, “free compute” promos are called out as paying for room, not model brain (@okeyccronald).

How PoYo answers: PoYo separates product access from subscription credit gymnastics:

• Credit-based pricing, no subscriptions — one-time top-ups; credits never expire (homepage).
• One API key for chat + media (llms.txt, API overview).
• Inspect remaining balance with GET /api/user/balance (user balance).
• Insufficient funds → 402, not a multi-day “wait for the grant” state (error codes).
• Failed generation tasks are not charged (homepage, llms.txt).

Public docs do not describe ChatGPT Pro / Business monthly API credit grants, promo “free compute that excludes tokens,” or reclaim flows. For PoYo balance help, use dashboard support / [email protected] (Getting Started).

Q6. Intro / scheduled price cliffs — don’t budget the promo rate.

What developers are complaining about: Builders warn not to size production budgets on launch pricing: Gemini 4 Argon intro rates are said to double after Nov 30 (@iamspiggle); Flash text token prices are flagged to rise on Jan 1, 2027 even as some Omni video $/sec drops (@Stan_Timek). Others remind that free Google Vids ≠ free API (@ZeroCost_Lab).

How PoYo answers: Treat every model’s live schema as source of truth — prices live in each model’s https://poyo.ai/models/<id>/llms.txt and on the model page; do not infer them from training data or launch tweets (llms.txt). Chat and media are prepaid credits drawn per successful output (homepage).

If you need Gemini-class chat on PoYo today, pick the documented model ID (for example cards under Google chat models) and re-check that file before you lock a unit-cost model. Video alternatives for draft→keeper workflows are listed under video overview.

Getting Started already sets a realistic stability expectation versus official providers. Public docs do not promise that PoYo will freeze a third-party lab’s intro promo forever, publish a multi-month price lock SLA, or mirror Google Vids free tiers.

Q7. Video APIs still expensive — regenerates burn credits.

What developers are complaining about: Kling models are called very expensive (@t_f_y_666). Seedance users say burning credits on regenerates hurts (@wallzgamepro). Sora economics keep getting mourned as failed / too costly (@QueenCityComet, @TheEaglegon).

How PoYo answers: Video shares the unified async path: POST /api/generate/submit → status poll or webhook (video overview, webhooks). Failed generation tasks are not charged (homepage, llms.txt).

Catalog entries matching what builders were arguing about (live prices on each llms.txt):

• Kling 4.0 — kling-4.0 (kling-4-0/llms.txt)
• Seedance 2.5 — seedance-2.5 (seedance-2-5/llms.txt)
• Sora 2 Official and related Sora IDs (video overview)
• Also listed: Veo 3.1, Wan 3.0, MiniMax/Hailuo, OmniHuman, and more (llms.txt)

Ops tips for regenerate waste:

• Prefer webhooks over aggressive polling.
• Do not blindly resubmit: a retry can create another billable task if the first already accepted (Getting Started).
• Download finished files within 3 days retention (Getting Started).
• Cap spend with key limits and stop on 402 (API key page, error codes).

Docs do not promise a “regenerate / dislike refund” for finished-but-undesired clips — only that failed tasks are not charged. There is no documented automatic multi-lab video failover.

Q8. Aggregator balance quirks + “don’t put secrets on the gateway.”

What developers are complaining about: Paid aggregator balances still surprise people: one OpenRouter user saw BILLING INSUFFICIENT with ~$0.80 left on a ~$0.018 image call (@alvinaputri). Others say they trust OpenAI / Anthropic / Google with secrets, not OpenRouter (@annexbaja). Stale model IDs on vibe-coded apps keep routing to unexpected backends (@AdamHoltererer). Durable Reddit threads still report 429s on paid accounts when upstream limits bite (r/openrouter).

How PoYo answers: PoYo is a unified API key across image, video, music, 3D, and chat — you pass an explicit model ID, and each model publishes live schema + pricing at https://poyo.ai/models/<id>/llms.txt (API overview, llms.txt).

Billing clarity documented today:

• Prepaid credits; 402 when the wallet cannot cover the request (error codes)
• 429 for rate limits, not as a substitute for empty balance (error codes)
• GET /api/user/balance for a real-time credits_amount (user balance)
• Key caps + IP allowlist + optional X-End-User-ID blocking (API key page, end-user identification)

What public docs do not claim:

• Cryptographic attestation that a response was signed by a specific upstream lab
• Automatic undisclosed model substitution when an ID is stale
• Automatic multi-provider failover when upstream returns 429/5xx
• A refund SLA for “I distrust this gateway” after a successful generation

Getting Started states stability may be slightly lower than official providers — set client-side preferences and hard stops accordingly.

Quick map

Browse models and live prices on poyo.ai, schemas via llms.txt, and the full docs index at docs.poyo.ai/llms.txt.