An OpenRouter invalid API key error usually appears as HTTP 401. Check the credential in the process that actually failed, test authentication separately, and correct the key or endpoint before retrying.
A 401 is an authentication failure
An OpenRouter 401 means the credential is missing, invalid, disabled, revoked, or expired. Retrying the same token will not repair it. Prove which process sends which value, then test the credential separately from model inference.
Checked October 15, 2026: use the current authentication docs and keys page.
1. Prove the variable exists
# macOS/Linux
if [ -n "$OPENROUTER_API_KEY" ]; then echo "key is set"; else echo "key is missing"; fiimport os
key=os.getenv("OPENROUTER_API_KEY")
print({"set":bool(key),"length":len(key) if key else 0})
if not key: raise SystemExit("OPENROUTER_API_KEY is missing")Never print the value. Check inside the actual notebook, container, CI job, systemd service, or worker—not only your interactive shell.
2. Test authentication alone
curl -sS -D /tmp/openrouter-headers.txt https://openrouter.ai/api/v1/key -H "Authorization: Bearer $OPENROUTER_API_KEY"
cat /tmp/openrouter-headers.txtIf this returns 401, stop debugging the model. Rotate or recreate the key, update the real secret store, restart the service, and test again. A successful response may expose budget details, so do not publish it.
3. Run a minimal inference
import os,requests
r=requests.post(
"https://openrouter.ai/api/v1/chat/completions",
headers={"Authorization":f"Bearer {os.environ['OPENROUTER_API_KEY']}",
"Content-Type":"application/json"},
json={"model":"openai/gpt-5.2","messages":[{"role":"user","content":"Reply: auth passed"}],"max_tokens":24},
timeout=(5,30),
)
print(r.status_code,r.text)
r.raise_for_status()Five places keys go wrong
- Wrong variable name: the application reads a different setting.
- Wrong process: the export never reached the running service.
- Whitespace or quoting: the secret manager stored extra characters.
- Revoked or expired: dashboard status changed.
- Wrong endpoint: the OpenRouter key was sent to another vendor URL.
OpenAI SDK configuration
from openai import OpenAI
import os
client=OpenAI(
base_url="https://openrouter.ai/api/v1",
api_key=os.environ["OPENROUTER_API_KEY"],
timeout=30.0,
)
response=client.chat.completions.create(
model="openai/gpt-5.2",
messages=[{"role":"user","content":"Say hello."}],
max_tokens=32,
)Make base URL and credential source explicit during diagnosis. Competing environment variables are a common migration bug.
401 versus neighboring errors
| Status | Meaning | Action |
|---|---|---|
| 401 | Invalid credentials | Fix or rotate key |
| 402 | Credits or spend limit | Check balance and cap |
| 403 | Permission or policy | Review guardrail/workspace |
| 429 | Rate limit | Back off |
Do not retry a 401
A 401 retry loop adds latency and noise without changing the credential. Fail fast, alert once with a redacted status/request ID, and make the health check fail. After rotation, restart processes that read secrets only at startup.
If the key leaked
Assume compromise. Disable/delete it, create a capped replacement, update every secret store, redeploy, and review usage. Do not paste the old value into a ticket to prove it existed.
Checklist
- Record UTC time, endpoint, status, and request ID.
- Check the failing process sees the variable.
- Call
GET /api/v1/key. - Confirm base URL and Bearer header.
- Check dashboard status and cap.
- Run one minimal request using a live model slug.
- Only then debug budgets, routing, or payloads.
OpenRouter invalid API key FAQ
Why 401 after changing the variable?
Long-running processes retain their startup environment. Restart the worker, notebook kernel, container, or service.
Will waiting fix it?
No. Waiting helps transient capacity errors, not invalid credentials.
Can a model cause 401?
Model and payload problems normally produce different statuses. Separate authentication with the key endpoint first.
Read next
See the 429 guide, key setup guide, and complete guide.
Official references
Documentation reviewed 15 October 2026. Examples illustrate the request pattern; confirm model availability and account settings before use. No uptime or performance benchmark is claimed.
