Deep Dive — Baidu Token Exchange: verified models, uninsured buyers

Baidu spent the past month quietly building a marketplace for other companies' models, then told the world about it this week. Token Exchange — 词元所, Ciyuansuo — went live at Baidu World 2026 on November 12, roughly a month after it began taking suppliers. Robin Li introduced it as "an exchange for large language models," and the analogy he reached for was a stock market: a stock exchange attracts good companies to list so investors can find and back them; Token Exchange, he said, gathers good models and good model providers so buyers can find and use tokens they trust, per Baidu's launch announcement.

The numbers Baidu put on stage were respectable rather than spectacular: more than 100 supply resources, over 50 million calls a day, more than 700 billion tokens a day. One day after the public launch, Baidu told Leiphone that 100-plus new supplier applications had arrived and more than 1,000 new customers had connected, according to Leiphone's report.

That is a small share of Chinese inference traffic, and Baidu knows it. The interesting question is not the volume. It is whether the thing Baidu built is actually an exchange — or a price-comparison page with a ratings agency bolted on, and a liability shield in the terms of service.

What is actually on the shelf

A week before launch, 36Kr looked at the platform and found 42 models listed, including DeepSeek, Kimi and Zhipu's GLM, behind a single endpoint that accepts both OpenAI and Anthropic request formats, as EastFrontier summarised. That dual-protocol detail matters more than it sounds: switching suppliers does not require rewriting the application, which is the whole point of an aggregator.

Each model can carry several suppliers. For each one the platform shows price per million input and output tokens, time to first token, throughput, seven-day success rate and call history. On the leaderboard 36Kr screenshotted, 68 model resources were ranked, with DeepSeek-V4.1-Flash leading on both calls and tokens over a seven-day window of 398 million calls and 5,134 billion tokens.

Two mechanisms sit on top. The first Baidu calls 验真 — authenticity: before listing, a supplier's model is fingerprinted against the original and run through capability, performance and availability tests, which is aimed at the two oldest tricks in the reseller trade, quietly substituting a cheaper model and overstating a model's parameters. The second is credit: spot checks, active probes, end-to-end monitoring of live calls, and a rating on five grades running from 优信 at the top to 冻结 at the bottom, with key results recorded on a blockchain.

Li's framing is that China's token resellers — the 中转站 layer — answer for none of this. They do not take responsibility for a model's quality, the stability of the service or the speed of the response, and in some cases the buyer cannot verify which model they are actually talking to. A platform that tests and rates its suppliers is a real answer to a real problem, and the Chinese market has more of that problem than anywhere else: a price war has pushed per-token rates low enough that margin lives in substitution rather than in service.

The fine print says the exchange is not an exchange

Here is where the analogy breaks. A stock exchange guarantees settlement. That is the product: you do not have to trust your counterparty, because the clearinghouse stands between you. Token Exchange verifies the asset and publishes the price, then steps back from the trade.

Its user agreement, updated November 11, limits the platform's role to access, identity verification, request forwarding, billing and displaying market information. Section 12.1 excludes platform liability for supplier-side faults, network fluctuation, model degradation and a supplier withdrawing a model unilaterally. Section 17.3 caps the platform's total liability at the technical service fees a customer paid in the previous twelve months. Section 10.4 leaves billing for failed or timed-out requests to the supplier's own reported status and the platform's published deduction rules, per CTOL's reading of the agreement.

Read together, that is coherent and honest: Baidu is selling a screening service, not insurance. The rating manual says as much, warning that a grade is not an absolute guarantee of a provider's real-world performance or continued availability. Any procurement team that has bought cloud capacity will recognise the shape of it.

But it does change what a buyer is paying for. You are paying for someone to have done the fingerprints and the dial tests, and for a warning when a supplier's grade slips. You are not paying for the thing an exchange normally sells, which is the right to stop caring about your counterparty. The buyer keeps that job, and keeps the backup route.

The 99.7% problem

The most useful data point in the whole launch is buried in a single listing. On the Guangzhou page for DeepSeek-V4.1-Flash, five suppliers were listed with their seven-day call counts. One of them, Bochuan Technology, recorded 328 million calls; the other four together recorded 839,500. By CTOL's arithmetic, that is about 99.7% of the listing's traffic through one supplier.

Bochuan also posted the lowest price: 0.74 yuan per million input tokens and 2.96 yuan per million output tokens, against 0.80 to 1.50 yuan input and 3.20 to 6.00 yuan output from the other four.

Take the caveat seriously before drawing conclusions: one model, one region, one week, and Baidu's own counters. Still, the pattern is exactly what you would predict if buyers route on price once the ratings have ruled out the fakes. Which suggests the rating is doing a narrower job than the marketing implies. It is a filter for authenticity, not a mechanism that rewards better service. In a commodity market, the cheapest credible supplier wins, and the other four listed suppliers are effectively advertising.

Baidu might argue that is fine — price discovery is what a market does. But Li's complaint was that relay stations compete on price while degrading quality underneath. An exchange that lets the cheapest route take essentially all the flow has solved the fraud problem without solving the incentive problem. And there is a second-order effect: if one supplier can hold 99.7% of a listing, the "many suppliers, one API" resilience pitch is thinner than the interface suggests. Failover to a supplier nobody uses is not a failover.

Baidu is the referee and a player

The uncomfortable design question is the one no launch event addresses. Baidu's own ERNIE models are sold on the same shelf as DeepSeek, Kimi and GLM. The platform rates suppliers on a methodology Baidu has not published. A buyer has to accept, on trust, that the company whose models compete on the leaderboard is also the company scoring the leaderboard.

Baidu has said the right things — neutral, transparent, trusted, public credit files — and the blockchain record is a reasonable attempt at making tampering visible. But no take rate has been disclosed, no scoring weights have been published, and no supplier has been publicly downgraded yet. Until one is, the credit system is a promise rather than a track record.

There is also the smaller structural mismatch the platform does not talk about: Baidu Cloud's Qianfan sells the same models through the same company. Token Exchange is, in part, Baidu's channel competing with its own channel.

Two designs, both called an exchange

The obvious comparison is OpenRouter, which aggregates models behind one API for Western developers and charges 5.5% to 8% on credit purchases rather than adding a margin to individual requests. The difference is the market, not the software. OpenRouter's customers pay with a card and mostly care about routing and uptime. Chinese enterprises buy through resellers because compute is stranded in regional data centres that cannot reach customers directly, and because procurement needs contracts, invoices and compliance paperwork that a startup with an API key cannot supply.

But the closer comparison is domestic, and it is the one that makes Baidu's design choice legible. Provincial governments got there first. Hubei Big Data Group opened its own token trading centre in September, with more than 200 model services and 326 partners, and a very different promise: not a rating, but a saving — 15% to 30% off what a company spends on models, delivered by routing each call to the cheapest competent provider, caching repeated prompts and failing over between suppliers. The bill is prepaid like phone credit and broken down by department. The gateway does key custody, content filtering and a full audit trail, as we covered when Hubei opened it. Inner Mongolia and Shaanxi have versions of their own.

Put the two side by side and they are answers to different questions. The provincial model says the buyer should not have to think: we pick the route, we hold the keys, we produce the audit and the invoice, and we take responsibility for the price. Baidu's model says the buyer should choose, and we will hand you the evidence — fingerprints, latency, success rates, a credit grade — with the choice and its consequences left where they were.

One of those is a utility and one is a credit bureau. Both are being sold as an exchange, and China will probably end up with both, because the buyers are different: a state-owned enterprise needs the audit trail and the unified bill more than it needs a supplier ranking, while a startup shipping an agent cares about price per million and which endpoint answers fastest.

Pan Helin, a member of the MIIT's information and communications economics committee, framed the underlying gap as structural: general-purpose compute periodically oversupplied, high-end intelligent compute persistently tight, and a cohort of small regional centres holding machines they cannot sell. The provincial exchanges attack that by making stranded capacity routable. Baidu attacks it by making it rateable — giving an unknown operator in a provincial data centre a credit record it can show a buyer in Shenzhen.

Seen that way, Token Exchange is less a bet on model quality than a toll booth on China's reseller economy — an attempt to be the layer where a fragmented, semi-legal, trust-poor market becomes billable. The ratings are how Baidu earns the right to sit in the middle.

The skeptic's case

Three ways this fails, none of them exotic.

Suppliers with real demand do not need it. If you are Zhipu or Moonshot, your customers come to you, and listing next to three resellers of your own model invites price comparison you cannot win. The suppliers who need a listing most are exactly the ones whose service quality is least certain — a selection problem the ratings can flag but not fix.

The ratings never bite. A rating system that has never publicly downgraded anyone is a marketing asset, and the moment it does downgrade a paying supplier, the commercial pressure arrives. Baidu has not explained how it separates the two.

The economics do not close. Marketplaces need a take rate, and Baidu has not published one. If the fee is invisible because it is zero during the land grab, then the ratings have to be funded by something else — most likely Qianfan compute — which puts the neutrality claim under more strain, not less.

What to watch

November 16. Baidu reports third-quarter results, and the quarter closed on September 30 — before nearly all of the exchange's life. So the print cannot show its revenue. What it can show is whether management mentions a fee, a paid-call volume, or a target, and whether Token Exchange appears in the deck as a business line or a slide.

A published fee. A take rate turns the platform into a business and makes its incentives legible. Its absence is the single biggest open question, and the easiest thing for a competitor to attack.

The first downgrade. One supplier publicly dropped to a lower grade, with the data behind it, would do more for the credibility of the rating system than a hundred supplier logos.

Whether the long tail consolidates. If every popular model ends up with one dominant supplier and a row of also-rans, the platform is a price index. If buyers spread across three or four suppliers per model, it is closer to infrastructure.

Prices are the one thing Chinese inference buyers have learned to read fluently — we have tracked the collapse in per-token rates and the awkward fact that halving the price of a token did not halve the bill to make it. What Baidu is selling is the next abstraction up: not a cheaper token, but a reason to believe the token is what the invoice says it is. For a buyer who has already learned to cut the bill without switching models, that is a different purchase — insurance against being lied to, priced by a company that also sells the thing being insured.

Whether Chinese enterprises will pay for that, and whether Baidu can rate its own model honestly while doing it, is the whole test. The first month's numbers say the shelf is full. They say nothing about whether anyone trusts the label.

Would you buy model access through a platform run by a company selling its own models? Write to us via our contact page.