Manage and de-risk your API keys with new Security Center

OpenRouter's new Security Center puts API key risks and cleanup tools under Settings > Security. It's available on all plan types. Admins can see every key; members see the keys they created.

You can filter by risk or idle time and select up to 500 keys to disable, archive, or add a spend limit. Disabling is reversible; archiving is permanent. Adding a spend limit doesn't overwrite an existing one.

The IP allowlist has its own tab and is limited to organization admins on Enterprise plans. It applies to every key in the account or organization, including existing keys, and rejects requests from other addresses with a 403 Forbidden.

OpenRouter says Security Center uses key metadata, spend, limits, and expiry, and never reads prompts or completions.