MyIP

本文件尚未翻譯成繁體中文，現顯示英文原文。

GET, PATCH and DELETE /keys/{hash}

Reading, updating and revoking a single key

Addresses one key by its hash: reads it, changes its name, limit or on/off state, or revokes it permanently. All three methods require a management key.

GET    https://openrouter.myip.co.kr/api/v1/keys/{hash}
PATCH  https://openrouter.myip.co.kr/api/v1/keys/{hash}
DELETE https://openrouter.myip.co.kr/api/v1/keys/{hash}

Why a hash addresses the key

The plaintext key leaves our system exactly once, in the creation response; we store only sha256(key). That hash is therefore the only name a key has. openrouter is built the same way, so we kept the field name hash.

bash
# If you still hold the plaintext, you can compute the hash yourself
printf '%s' "sk-mo-v1-8f2b6d1e…" | sha256sum

If the plaintext is gone, get the hash from the GET /keys listing. The other direction — hash back to plaintext — is impossible for anyone, administrators included.

Authentication

Authorization: Bearer sk-mo-mgmt-v1-…. Management keys only. An inference key returns 401 invalid_api_key.

A management key can only see keys on its own account. Passing another user's key hash returns 404: an unknown hash and someone else's hash produce identical responses, so the endpoint never reveals whether a hash exists.

Path parameter

hashstring必填

sha256(plaintext key) as 64 hex characters. Use the hash field from a GET/POST /keys response verbatim.

GET — read

Returns a single key object with exactly the same fields as an item in GET /keys.

bash
curl "https://openrouter.myip.co.kr/api/v1/keys/9f2c1d0a7b3e4f5061728394a5b6c7d8e9f0112233445566778899aabbccddee" \
  -H "Authorization: Bearer $MYIP_MANAGEMENT_KEY"
json
{
  "data": {
    "created_at": "2026-09-01T02:11:40.881Z",
    "updated_at": null,
    "hash": "9f2c1d0a7b3e4f5061728394a5b6c7d8e9f0112233445566778899aabbccddee",
    "label": "sk-mo-v1-au7…890",
    "name": "production",
    "disabled": false,
    "limit": 100000,
    "usage": 25500
  }
}
hashstring

The hash you requested, echoed back.

labelstring

The masked string. It cannot be used to authenticate.

disabledboolean

true means the key cannot run inference. It merges the user's own off switch with every non-active status: suspended for lack of credit, suspended by an administrator, or revoked.

limitnumber | null

Spend limit in won. null means unlimited.

usagenumber

Spend during the limit period, in won, with boundaries in Asia/Seoul.

Revoked keys do not appear in the GET /keys listing, but a revoked key whose hash you know is still readable here, so that a revocation can be confirmed after the fact. Requests made with that key still get 401.

PATCH — update

Changes only the fields you send; omitted fields are left alone.

namestring

A new name. An empty or whitespace-only value returns 400.

disabledboolean

true switches the key off, false switches it back on. A non-boolean returns 400.

limitnumber | null

A new spend limit in won. Sending an explicit null removes the limit. Omitting the field and sending null mean different things.

bash
curl -X PATCH "https://openrouter.myip.co.kr/api/v1/keys/9f2c1d0a7b3e4f5061728394a5b6c7d8e9f0112233445566778899aabbccddee" \
  -H "Authorization: Bearer $MYIP_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "production (paused)", "disabled": true, "limit": 200000}'

The response is the key object after the update.

json
{
  "data": {
    "created_at": "2026-09-01T02:11:40.881Z",
    "updated_at": "2026-09-04T05:40:12.907Z",
    "hash": "9f2c1d0a7b3e4f5061728394a5b6c7d8e9f0112233445566778899aabbccddee",
    "label": "sk-mo-v1-au7…890",
    "name": "production (paused)",
    "disabled": true,
    "limit": 200000,
    "usage": 25500
  }
}

To clear a limit and nothing else:

bash
curl -X PATCH "https://openrouter.myip.co.kr/api/v1/keys/$KEY_HASH" \
  -H "Authorization: Bearer $MYIP_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit": null}'

DELETE — revoke

Revokes the key permanently.

bash
curl -X DELETE "https://openrouter.myip.co.kr/api/v1/keys/9f2c1d0a7b3e4f5061728394a5b6c7d8e9f0112233445566778899aabbccddee" \
  -H "Authorization: Bearer $MYIP_MANAGEMENT_KEY"
json
{ "data": { "success": true } }
successboolean

Always true. Revoking an already-revoked key is not an error; the call is idempotent.

Revoking a key leaves its usage records and ledger entries intact: deleting money that has already been charged would break the accounting. So total_usage from GET /credits does not go down after a revocation.

Errors

Statuserror_typeWhen
400invalid_requestBody is not valid JSON. name is an empty string. disabled is not a boolean. limit is neither a number nor null
401invalid_api_keyNo header. Called with an inference key. The management key is unknown, switched off, or revoked
401expired_api_keyThe management key has expired
402insufficient_creditsThe management key is suspended_no_credit
403key_suspendedAn administrator suspended the management key
404not_supportedNo key with that hash, or the key belongs to another user
500serverAny other server-side failure

The 404 body looks like this. A hash that does not exist and a hash that belongs to someone else produce byte-identical responses, closing the path by which response differences would reveal that a hash exists.

json
{
  "error": {
    "code": 404,
    "message": "지원하지 않는 경로입니다: key 9f2c1d0a7b3e4f50…",
    "metadata": { "error_type": "not_supported" }
  }
}

message is written in Korean, the service's primary locale. Branch on metadata.error_type, not on the message text.

Related

最後更新於 2026年9月5日