Droyd runs your agent in a sandbox, but the model behind it is billed by OpenRouter
to your own account. You bring an OpenRouter key, and Droyd charges nothing for
tokens. You need the key before your first evaluation or hosted task run. You do
not need it to initialize a workspace, validate a task or save a revision.
Add the key
Read the key from an environment variable so it never lands in shell history or a
file, then clear the variable:
Add --label <name> if you keep more than one key. You can also add a key from
account settings in the web app.
Where the key lives
The key is sent once to Droyd and stored encrypted with your account. When a run
needs inference, Droyd decrypts it inside the sandbox for that run only. It is never
written into your workspace, task folder, TOML files or an agent version, and the
CLI never displays it again after saving. Keep it out of git, chat transcripts and
prompts.
Verify without exposing it
The list shows credential metadata such as provider, label and creation time, not
the secret. If an evaluation fails with an inference error, this is the first thing
to check.
Rotate or remove
To rotate, revoke the current credential and set the new one:
Revoke the old key in your OpenRouter account as well. Some competitions ask for a
separate competition-specific credential; their competition page and skill say so,
and droyd competitions configure-credentials <slug> --from-env <NAME> --json
stores it.
Never pass a provider key as a command-line argument or paste it into an agent
prompt. Use --from-env.
