Management API keys

There are two kinds of key, and they do not overlap:

Sending an inference key to /api/v1/keys, or a management key to /chat/completions, returns 401 invalid_api_key. The separation is deliberate: a key that can both spend money and mint new keys is a much worse thing to leak.

Getting a management key

Create one in the dashboard under Settings → API keys (/settings/keys). It is shown once, in plaintext, and never again — we store only its SHA-256 hash.

export MYIP_MGMT_KEY="sk-mo-mgmt-v1-..."

Identifying a key: the hash

Keys are addressed by hash — the SHA-256 of the full plaintext key, as 64 hex characters. Since we never store the plaintext, the hash is the only handle that exists. You get it from the create and list responses.

Endpoints

All of these require Authorization: Bearer $MYIP_MGMT_KEY.

The list contains inference keys only, and excludes revoked ones. The management key does not list itself.

Create a key

curl -X POST https://openrouter.myip.co.kr/api/v1/keys \
  -H "Authorization: Bearer $MYIP_MGMT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "batch-worker", "limit": 50000, "limit_reset": "monthly" }'

The response:

{
  "data": {
    "created_at": "2026-09-04T02:11:43.201Z",
    "updated_at": null,
    "hash": "9f2c…c41a",
    "label": "sk-mo-v1-au7…890",
    "name": "batch-worker",
    "disabled": false,
    "limit": 50000,
    "usage": 0
  },
  "key": "sk-mo-v1-au7c2f…c890"
}

List keys

curl https://openrouter.myip.co.kr/api/v1/keys \
  -H "Authorization: Bearer $MYIP_MGMT_KEY"

{ "data": [ { "hash": "9f2c…c41a", "name": "batch-worker", "disabled": false, "limit": 50000, "usage": 1234.5 } ] }

Update a key

PATCH accepts name, disabled, and limit. Omitted fields are left alone; "limit": null clears the cap.

# Pause a key without destroying it
curl -X PATCH https://openrouter.myip.co.kr/api/v1/keys/9f2c…c41a \
  -H "Authorization: Bearer $MYIP_MGMT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "disabled": true }'

limit_reset is fixed at creation time. To change the window, create a new key.

Revoke a key

curl -X DELETE https://openrouter.myip.co.kr/api/v1/keys/9f2c…c41a \
  -H "Authorization: Bearer $MYIP_MGMT_KEY"

{ "data": { "success": true } }

Inspecting the key you are currently using

An inference key can look itself up — no management key needed:

curl https://openrouter.myip.co.kr/api/v1/key \
  -H "Authorization: Bearer $MYIP_API_KEY"

GET /api/v1/auth/key is an alias for the same response. It reports limit, usage, limit_remaining, limit_reset, per-period usage, and whether the key is a management key. All amounts are KRW.

Fields that exist only for wire compatibility are inert here: is_free_tier is always false, the byok_* counters are always 0 because we do not support bring-your-own-key, and rate_limit is a deprecated field that is safe to ignore.

Errors

Why the dashboard uses a different API

/api/v1/* accepts bearer tokens only. The browser dashboard is authenticated with a session cookie and calls a separate endpoint that shares the same underlying key logic. Mixing cookie authentication into the SDK surface would open a CSRF hole without making anything easier — so we do not.