Skip to main content
OpenRouter provides endpoints to programmatically manage your API keys, enabling key creation and management for applications that need to distribute or rotate keys automatically.

Creating a Management API Key

To use the key management API, you first need to create a Management API key:
  1. Go to the Management API Keys page
  2. Click “Create New Key”
  3. Enter a name and choose an expiration
  4. Copy the key when it is shown. You will not be able to see it again
Management keys cannot be used to make API calls to OpenRouter’s completion endpoints - they are exclusively for administrative operations.

Expiration

We recommend setting an expiration date on every management key. A leaked management key could create, edit and delete the API keys in your account other than those provisioned by a Connect client, and one with no expiration stays valid until you delete it.
  • The expiration is fixed when the key is created and cannot be changed afterwards. To extend access, create a new key and delete the old one.
  • Once a key’s expiration passes, every request that uses it fails with 401 Unauthorized and the message API key expired. Expired keys still appear on the Management API Keys page until you delete them.
Automations that call the key management API with an expiring management key must be given a new key before the old one expires, or they will start receiving 401 API key expired responses. Schedule rotation ahead of the expiration date shown next to the key.

Use Cases

Common scenarios for programmatic key management include:
  • SaaS Applications: Automatically create unique API keys for each customer instance
  • Key Rotation: Regularly rotate API keys for security compliance
  • Usage Monitoring: Track key usage and automatically disable keys that exceed limits (with optional daily/weekly/monthly limit resets)

Example Usage

All key management endpoints are under /api/v1/keys and require a Management API key in the Authorization header.

Response Format

API responses return JSON objects containing key information:
When creating a new key, the response will include the key string itself. Read more in the API reference.

Routes That Require a Management Key

The following documented routes reject regular API keys and must be called with a Management API key.

Analytics

API Keys

BYOK

Credits

Generations

Guardrails

Observability

Organization

SCIM

Workspaces