Manage and de-risk your API keys with new Security Center

OpenRouter's Security Center puts every API key across a team's workspaces in one list, with a risk score for each. OpenRouter's announcement says it is available on all plan types, under Settings > Security.

The feature came out of an audit of OpenRouter's own account, which turned up over 1,000 active keys for 85 employees. Many had no spend limit, and 168 hadn't been used in months.

• Overview: counts keys with no spend limit, keys that never expire, keys unused or idle for 90+ days, and keys that are safe to remove. It also lists what to fix first, such as setting spend limits, replacing non-expiring keys, turning on key spend alerts, and enforcing a maximum key lifetime.
• Key safety: lists every key that can still make requests, including MCP and management keys, with owner, last use, spend limit and expiration side by side. Admins see every key, and members see the keys they created. Risk comes from the spend limit and expiration. Usage sets a separate label: Safe, Review or In use.
• Bulk actions: filter by risk or idle time, then select up to 500 keys to disable, archive, or add a spend limit. Disabling is reversible and archiving isn't. Adding a limit never overwrites an existing one. Admins can copy a CSV of a recommendation's keys and owners.
• IP allowlist: moved out of privacy settings into its own tab. Entries can be an IPv4 or IPv6 address or a CIDR range, each with a label. Requests from other addresses get a 403 Forbidden, and the list applies to every key in the account or organization, including old ones. It is available to organization admins on Enterprise plans.

OpenRouter says the Security Center works only from key metadata, spend, limits and expiry, and never reads prompts or completions.

OpenRouter

One API for 500+ AI models across 80+ providers — pay with credits that work anywhere, with automatic fallback when a provider goes down.

View OpenRouter →

Original source