How to get an OpenRouter API key

An OpenRouter API key is one string that works with every model on OpenRouter, from GPT and Claude to the free open-weight ones. Getting one takes two minutes. Setting it up so a leak or a runaway script can’t drain your balance takes one more.

Create the key, step by step

1. Sign up at openrouter.ai. The account is free.
2. Open the API Keys page at openrouter.ai/settings/keys. Since April 2026, every key lives inside a workspace.
3. Create a key. Give it a name you’ll recognize later, like the app it’s for, and pick a credit limit or leave it unlimited.
4. Copy the key straight away. OpenRouter shows the full string only once. It starts with sk-or-v1-, followed by 64 more characters.

If you lose it, you can’t view it again. Create a new key and delete the old one.

One key per app is a good habit. When an app misbehaves or a key leaks, you delete that one key and everything else keeps working.

Do you need credits?

For paid models, yes. OpenRouter’s terms say you buy credits to make API calls, and new accounts get only a small free allowance to test with. The minimum purchase is $5. Paying by card adds a 5.5% fee with a $0.80 minimum, so a $5 top-up comes to $5.80 at checkout.

Without credits, the key still works on free models, capped at 50 requests a day. Our guide to OpenRouter’s free models covers those limits. Once you’re paying, Auto Recharge can top your balance up when it drops below an amount you choose. OpenRouter’s terms also let it expire unused credits 365 days after purchase, so don’t park a large balance there.

Put a limit on the key

A credit limit caps what one key can spend. You can make it reset daily, weekly or monthly, at midnight UTC. Once the limit is used up, OpenRouter rejects requests with that key until it resets or you raise it. You can also give a key an expiry date when you create it, though you can’t change that date later.

Two more settings take a minute each. Every key has a Notifications section with a spend limit alert. And the Security page, added in September 2026, lists keys that have no spend limit and never expire, so you can fix them in one pass.

If OpenRouter created a key for you during sign-up, it already has a $100 limit and expires after 180 days.

Check that it works

The quickest test is one request from a terminal. OpenRouter uses the same request format as OpenAI’s API, with https://openrouter.ai/api/v1 as the base URL and your key in an Authorization header.

curl https://openrouter.ai/api/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -d '{"model": "openai/gpt-6-luna", "messages": [{"role": "user", "content": "Say hello"}]}'

A reply with a message in it means the key is good. To see the key’s own numbers, send a GET request to https://openrouter.ai/api/v1/key with the same header. It returns the key’s limit and what’s left of it, its spending today, this week and this month, and how many free-model requests you have left today. The Activity page shows the same spending broken down by key, and the Logs page lists every request.

From here, our guide on how to use OpenRouter covers the chat page, apps, code and the routing settings.

What the errors mean

When a request fails, the status code usually tells you why.

• 401. The key is invalid or disabled. Check for a missing character or a stray space from copying.
• 402. The account or the key is out of credits. It can show up on free models too, if your balance has gone negative.
• 403. A guardrail, a moderation flag or missing permissions blocked the request.
• 429. You’re being rate limited. On free models, the 20-per-minute and daily caps are the likely cause.
• 502 and 503. The problem is on the model side. Either the model is down, or no provider matches your routing settings.

If your key leaks

OpenRouter is a GitHub secret scanning partner. A key pushed to a public GitHub repo gets flagged, and GitHub’s push protection can stop the push before it happens. When OpenRouter decides a key is compromised, it emails you and asks you to delete the key and create a new one. Do it straight away.

Your Security page also lets you disable a key, which you can undo, or archive it, which you can’t. The cheapest insurance is the limit from earlier. A leaked key with a $10 cap stops at $10.

An OpenRouter key versus BYOK on OpenRouter

Two different things share the name. Your OpenRouter API key is the one you paste into apps. OpenRouter also has its own BYOK feature, which works the other way round. You give OpenRouter keys from providers like OpenAI or Anthropic, and it routes requests through your accounts with them. On pay-as-you-go, the first $25,000 of list-price usage a month is free of fees, then OpenRouter charges 5%.

When an app like UtilEngine asks you to bring your own key, it means the first kind.

Using the key in your browser

UtilEngine, our extension for Chrome, Brave and Edge, is one place to put it. Open AI Settings and paste the key. UtilEngine checks it by sending one tiny request to a paid model, so add credits before you paste. Once the check passes, the key stays in that browser’s extension storage and never syncs to our servers or your other devices. Ask AI and Chat then work on any page, with 85 models to pick from.

UtilEngine is $49 once, and OpenRouter bills your tokens directly. The bring-your-own-key page explains how that split works.

Common questions

Is an OpenRouter API key free?

Creating one is free. You pay for usage through credits, unless you stick to the free models and their daily cap.

Can I see my key again after creating it?

No. OpenRouter shows the full key once. If you lose it, create a new key and delete the old one.

Can I use one key in several apps?

Yes, but separate keys are easier to manage. Each gets its own limit and its own row in the Activity page, and a leak costs you one key instead of all of them.

Why does my new key return a 402 error?

Your account has no credits, or the key’s own limit is used up. Add credits, or raise the key’s limit on the API Keys page.

Does UtilEngine see my OpenRouter key?

The key stays in your browser’s extension storage, and requests go from your browser straight to OpenRouter. It never syncs to UtilEngine’s servers.