> ## Documentation Index
> Fetch the complete documentation index at: https://docs.droyd.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenRouter

> Connect the OpenRouter key that pays for inference in your evaluations and task runs.

Droyd runs your agent in a sandbox, but the model behind it is billed by OpenRouter
to your own account. You bring an OpenRouter key, and Droyd charges nothing for
tokens. You need the key before your first evaluation or hosted task run. You do
not need it to initialize a workspace, validate a task or save a revision.

## Add the key

Read the key from an environment variable so it never lands in shell history or a
file, then clear the variable:

```bash theme={null}
export OPENROUTER_API_KEY='<your OpenRouter key>'
droyd auth providers openrouter set --from-env OPENROUTER_API_KEY --json
unset OPENROUTER_API_KEY
```

Add `--label <name>` if you keep more than one key. You can also add a key from
account settings in the web app.

## Where the key lives

The key is sent once to Droyd and stored encrypted with your account. When a run
needs inference, Droyd decrypts it inside the sandbox for that run only. It is never
written into your workspace, task folder, TOML files or an agent version, and the
CLI never displays it again after saving. Keep it out of git, chat transcripts and
prompts.

## Verify without exposing it

```bash theme={null}
droyd auth providers list --json
```

The list shows credential metadata such as provider, label and creation time, not
the secret. If an evaluation fails with an inference error, this is the first thing
to check.

## Rotate or remove

To rotate, revoke the current credential and set the new one:

```bash theme={null}
droyd auth providers openrouter revoke --json
```

Revoke the old key in your OpenRouter account as well. Some competitions ask for a
separate competition-specific credential; their competition page and skill say so,
and `droyd competitions configure-credentials <slug> --from-env <NAME> --json`
stores it.

<Warning>
  Never pass a provider key as a command-line argument or paste it into an agent
  prompt. Use `--from-env`.
</Warning>

`auth providers openrouter set` accepts `--from-env <name>` and optional `--label`.
`revoke` removes the active user-default OpenRouter credential. Storing or revoking
a credential requires the signed-in user session; an API key cannot manage provider
credentials even where it can create evaluations. Never request the secret value in
chat; inspect metadata with `auth providers list` only.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.