How to Get and Use an OpenRouter API Key

What an OpenRouter API key does

An OpenRouter API key is the Bearer credential your application sends to OpenRouter. It authorizes requests, links usage to your account, and can carry a per-key spending limit. It is not an OpenAI, Anthropic, or Google key: create it in OpenRouter and use it with the OpenRouter API base URL.

Checked October 15, 2026: OpenRouter’s authentication documentation recommends a credit limit on every key. Treat that limit as a security control, not a substitute for secret storage.

Plan the key before creating it

• Name: use purpose and environment, such as support-triage-dev.
• Limit: choose a small cap appropriate to the workload.
• Location: keep the key on a server, worker, or secret manager.
• Owner: record who maintains it and when it should be reviewed.
• Model policy: validate allowed models in application code.

A capped key limits damage; it does not make a leaked key harmless. Use separate development and production keys so a test incident cannot consume the production budget.

Create the key step by step

1. Sign in at OpenRouter.
2. Open the API Keys page.
3. Choose Create Key and give it a descriptive name.
4. Set a credit limit and reset period appropriate to the job.
5. Copy the secret once and store it immediately.
6. Add credits if you plan to call paid models.
7. Run a short server-side test with a low output limit.

Store it as an environment variable

export OPENROUTER_API_KEY="sk-or-your-key"
# Confirm only that it exists; never print the value.
test -n "$OPENROUTER_API_KEY" && echo "key loaded"

Use an encrypted secret store in CI and production. A local .env file must be excluded from source control. Never put the key in client-side JavaScript, a mobile binary, a public notebook, a screenshot, or a WordPress post.

Make the first request

curl https://openrouter.ai/api/v1/chat/completions   -H "Authorization: Bearer $OPENROUTER_API_KEY"   -H "Content-Type: application/json"   -d '{
    "model": "openai/gpt-5.2",
    "messages": [{"role":"user","content":"Reply with exactly: key works"}],
    "max_tokens": 10
  }'

The key belongs in the Authorization header. Optional attribution headers are not authentication. Confirm any example model in the live model catalog before use.

Python example with clear errors

import os
import requests

key = os.environ["OPENROUTER_API_KEY"]
body = {
    "model": "openai/gpt-5.2",
    "messages": [{"role":"user","content":"Explain capped keys in one sentence."}],
    "max_tokens": 80,
}
response = requests.post(
    "https://openrouter.ai/api/v1/chat/completions",
    headers={"Authorization": f"Bearer {key}", "Content-Type":"application/json"},
    json=body, timeout=30,
)
if response.status_code != 200:
    raise RuntimeError(f"OpenRouter returned {response.status_code}: {response.text}")
print(response.json()["choices"][0]["message"]["content"])

Never log request headers. A harmless-looking debug statement can expose the credential even when the request itself is encrypted.

Use the OpenAI-compatible SDK

from openai import OpenAI
import os

client = OpenAI(
    base_url="https://openrouter.ai/api/v1",
    api_key=os.environ["OPENROUTER_API_KEY"],
)
result = client.chat.completions.create(
    model="openai/gpt-5.2",
    messages=[{"role":"user","content":"Say hello in five words."}],
    max_tokens=20,
)
print(result.choices[0].message.content)

Check limits before a batch

curl https://openrouter.ai/api/v1/key   -H "Authorization: Bearer $OPENROUTER_API_KEY"

The documented response can include the key label, limit, remaining amount, usage, budget data, and free-model request information. Use it for monitoring, but still handle the race where another worker spends the remaining budget.

Security practices that matter

One key per environment

Separate keys make revocation, attribution, and budget control possible. Do not share one unlimited key across a website, worker, notebook, and contractor script.

The smallest useful cap

Estimate the job, cap request size and concurrency, and alert before exhaustion. An enormous cap is not an emergency brake.

Rotate after exposure

If a key appears in a repository, log, ticket, or screenshot, delete or disable it, create a replacement, update the secret store, redeploy, and inspect usage. Treat the old value as permanently compromised.

What common errors mean

Status	Likely issue	First action
401	Missing, invalid, revoked, or expired key	Check the process, Bearer header, and key status
402	Credits or spending limit	Inspect balance and GET /api/v1/key
403	Workspace, guardrail, or permission restriction	Review policy and budget settings
404	Invalid model or no eligible endpoint	Query the live model catalog
429	Quota or rate limit	Read headers and back off

OpenRouter API key FAQ

Can I put the key in frontend code if the app is private?

No. Users can inspect code and network requests. Keep the secret server-side and expose only the narrow operation the frontend needs.

Should production keys be unlimited?

Usually not. Use a realistic cap, bounded request size, monitored concurrency, and a rapid-revocation procedure.

What if my key is exposed?

Disable it immediately, replace it, update all deployments, and review usage. Do not wait for a billing anomaly.

What should I read next?

Continue with the complete OpenRouter API guide, the 401 troubleshooting guide, and the n8n credentials guide.

Official references

• Authentication

Documentation reviewed 15 October 2026. Examples illustrate the request pattern; confirm model availability and account settings before use. No uptime or performance benchmark is claimed.