Providers / OpenRouter
AI APIs
OpenRouter API keys and credentials
What every OpenRouter credential a founder holds does, whether it expires, and what tends to break. Each fact links to OpenRouter's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| API key (regular) | You choose | Full access only |
| Management (provisioning) API key | You choose | Full access only |
| OpenRouter account login | Not documented | – |
Each credential
API key (regular)
- You choose
- Full access only
- Expiry readable by API
Optional expires_at on creation (ISO 8601 UTC, must include seconds; minute-precision rejected). Optional spending limit in USD (limit) with limit_reset of daily, weekly, or monthly (midnight UTC; weeks run Monday to Sunday). Keys can be disabled. List responses include expires_at (null if none), disabled, limit, limit_remaining, limit_reset, created_at, updated_at, hash. Key management endpoints require a management key. Limits are spending caps, not permission scopes.
Management (provisioning) API key
- You choose
- Full access only
Administration only: cannot call completion endpoints. Created on the Management API Keys page with a name and an expiration; the key is shown once. The expiration is fixed at creation and cannot be changed. After expiry requests fail with 401 'API key expired'. Unscoped and account-wide across all workspaces. For organizations only Organization Admins can create one.
OpenRouter account login
- Not documented
Dashboard login at openrouter.ai.
What usually goes wrong
- Regular key reaches its USD limit (limit_remaining hits zero) and requests start failing until the reset interval
- Key passes its expires_at and requests fail after expiry
- Management key expires silently and provisioning automation breaks; expiry cannot be changed, only recreated
- Management key is account-wide, so a leak exposes every workspace
- Management key shown only once at creation
Renewals and billing
Per-key spend: GET /api/v1/key (usage, usage_daily, usage_weekly, usage_monthly, limit, limit_remaining, is_management_key) and key list responses (GET /api/v1/keys, management key). Credits (GET /api/v1/credits) and activity (GET /api/v1/activity) are documented as management-key endpoints. Payment method terms not checked.
What OpenRouter's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Whether GET /api/v1/key accepts regular API keys (spec says bearer, does not say which key types)
- Whether GET /api/v1/activity returns per-day data (not stated on the limits page)
- Default expiration for regular keys (none documented; expires_at is optional)
- Maximum lifetime for management keys and whether a 'never' expiry option exists
- Whether expires_at is returned for management keys in the list endpoint
- Credits, billing, and payment terms
Rotating or replacing a OpenRouter key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- openrouter.ai/docs/guides/overview/auth/provisioning-api-keys
- openrouter.ai/docs/api/api-reference/api-keys/create-keys
- openrouter.ai/docs/api/api-reference/api-keys/list-api-keys
- openrouter.ai/docs/api/api-reference/api-keys/get-current-key
- openrouter.ai/docs/api/reference/limits
Related providers
Keep track of every OpenRouter key
StackHangar stores your OpenRouter keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.