orkey

A tiny CLI that mints spend-capped OpenRouter API keys. I use it to hand coding agents a key with a $5 ceiling instead of my real one. If an agent leaks it or loops on an expensive model, the cap eats the damage, and I burn the key when it's done.

Setup

You need Rust and an OpenRouter account.

1. Install:

   git clone https://github.com/noahdunnagan/orkey && cd orkey
   cargo install --path .

2. Create a management key at openrouter.ai/settings/management-keys. This is the admin credential orkey uses to create and delete keys. It can't spend on inference itself.

3. Put it where orkey looks:

   mkdir -p ~/.config/orkey
   cat > ~/.config/orkey/key   # paste the key, hit enter, then ctrl-d
   chmod 600 ~/.config/orkey/key

   Setting OPENROUTER_MANAGEMENT_KEY works as a fallback, but the file keeps the key out of your shell history.

Usage

orkey mint        # new key with a $5 cap
orkey mint 2.50   # custom cap in USD
orkey ls          # hash  name  $used/$cap  [off] if disabled
orkey burn <hash> # delete a key

mint prints the key on stdout and its hash on stderr, so KEY=$(orkey mint) captures just the key. OpenRouter shows the raw key exactly once, at creation. After that you only have the hash, which is what burn takes.

Worth knowing

• The cap is checked when a request is admitted, so one long streaming response can overshoot it a little. Leave some headroom.
• A key that hits its cap gets 402 or 403 from OpenRouter. That's a billing stop, retrying won't help.
• Keys never expire. The cap limits the damage either way, but burn keys when you're done with them.
• Minted keys spend from your shared account balance. A $5 cap on an empty account is just a fancy way to get 402s.