openrouter-key-management

OpenRouter Key Management

Use this skill when managing OpenRouter API keys across the fleet: checking per-key usage and limits, updating spending caps, restricting model access, setting up usage alerts, or creating/rotating keys.

Architecture

OpenRouter has two key-management mechanisms that stack:

1. Per-key spending limits (limit field) — set on individual API keys via the Management API. Hard cap: requests are rejected when exceeded.
2. Guardrails (organization-level) — restrict models, providers, data retention per key or per member. Model allowlists, provider allowlists, and budget limits that layer on top of per-key limits (the lower limit wins).

Both require a Management API key — a special key type that can only manage keys, not make inference calls.

Key inventory and status check

All keys on this fleet are tracked in ~/.weblyfe-secrets/orgo-openrouter-keys.env (chmod 600, never git-tracked). Structure:

ORGO_APPIE6_FERDOWS=sk-or-...
OWN_APPIE1=sk-or-...

Check all keys' current status

Each key can query its own status (no Management key needed):

import json, urllib.request

keys = {
    # Load from env file
}
base_url = "https://openrouter.ai/api/v1/key"

for name, api_key in keys.items():
    req = urllib.request.Request(base_url)
    req.add_header("Authorization", f"Bearer {api_key}")
    with urllib.request.urlopen(req, timeout=10) as resp:
        data = json.loads(resp.read())
        d = data.get('data', {})
        print(f"{name}: limit=${d.get('limit')}, "
              f"remaining=${d.get('limit_remaining')}, "
              f"usage=${d.get('usage',0):.4f}, "
              f"reset={d.get('limit_reset')}")

Response fields on each key:

Field	Type	Meaning
limit	number or null	Spending limit in USD (null = unlimited)
limit_remaining	number or null	Remaining credits for this period
limit_reset	"daily"/"weekly"/"monthly" or null	When limit resets
usage	number	Total credits used (all time)
usage_daily/weekly/monthly	number	Usage for current period
disabled	boolean	Whether the key is active
include_byok_in_limit	boolean	Whether BYOK usage counts toward limit