OpenRouter
Connect an OpenRouter account to Safeguard. The management key the connector needs, which OpenRouter keys work, what Safeguard reads, and step-by-step setup.
Availability
This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.
What it does
The OpenRouter card connects Safeguard to your OpenRouter account, read only. Safeguard lists the account's API keys in every workspace, its credits, and which models and providers your keys used in the last 30 days, with requests, tokens and spend per model. It checks key age, keys nobody uses, keys whose creator has left, and whether every key runs under a guardrail that enforces zero data retention with model training off, and keeps the model usage as AI usage evidence. The card is switched on per workspace; find it under Integrations in the AI models group. Clicking it opens Compliance > Connectors, where the OpenRouter connector is added.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | Nothing: OpenRouter has no public account data | An OpenRouter management API key |
| Credential needed | Not applicable | A management API key created by an Org Admin |
| What Safeguard reads | Not applicable | The members, API keys, guardrails, credits and 30-day activity of your account |
Only the private mode applies. OpenRouter's public model list is not account data, and Safeguard does not use it here.
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Management API key | Always | Created by an Org Admin on the Management API Keys page. It cannot call models. |
| Normal API key (model key) | Not supported | It can call models but cannot list members, keys, credits or activity; OpenRouter refuses those reads |
Permissions required
OpenRouter documents no read-only management key: the same key can create and delete keys and edit guardrails. Safeguard only sends GET requests with it.
Management API key
| OpenRouter endpoint Safeguard calls | Required? | What Safeguard uses it for |
|---|---|---|
GET /api/v1/organization/members | Required | The members, matched to your people register (accounts linked, leavers, admin count) |
GET /api/v1/workspaces and GET /api/v1/keys (every workspace, disabled and expired keys too) | Required | Key age, keys not used in 90 days (last_used_at) and keys whose creator left |
GET /api/v1/guardrails and GET /api/v1/guardrails/assignments/keys | Required | Whether every enabled key runs under a guardrail with zero data retention on and training off |
GET /api/v1/credits | Required | The credit balance in the usage evidence |
GET /api/v1/activity | Required | The models and providers used in the last 30 completed UTC days, with requests, tokens and spend |
Least privilege: OpenRouter offers no narrower key for these reads. Create a dedicated management key named for Safeguard, give it an expiry, and revoke it when you disconnect.
Token types
| Key type | Works? | Notes |
|---|---|---|
| Management API key (formerly called a provisioning key) | Yes | The only key that can list keys, credits and activity |
| Normal API key (model key, created under Keys) | No | OpenRouter answers the management reads with an error, and the tests show it |
| OAuth (PKCE) user key | No | It is a model key |
Expiry: set an expiry on the management key and rotate it at least every 90 days.
What we never need: a model key, prompt or completion content (Safeguard never calls OpenRouter's generation content endpoints), billing changes, or any write.
Step-by-step setup
Create the credential in OpenRouter
- Sign in to OpenRouter as an Org Admin and open the Management API Keys page in your account settings.
- Click Create, name the key
Safeguard, set an expiry, and create it. - Copy the key. OpenRouter shows it once.
Or with the OpenRouter API
OpenRouter has no CLI that creates a management key. To check the key before you paste it into Safeguard:
curl -s https://openrouter.ai/api/v1/key -H "Authorization: Bearer $OPENROUTER_MANAGEMENT_KEY"The answer's data.is_management_key must be true.
Connect it in Safeguard
- Open Integrations, then the OpenRouter card in the AI models group. It opens Compliance > Connectors.
- Choose OpenRouter, paste the key into Management key and save.
- Run the connector's tests. The card shows Verified only after a successful read.
Webhooks and triggers
This integration has no webhooks. The connector's tests run on their daily schedule, and you can run them by hand from Compliance > Connectors.
What we read and store
- Read: members (id, email, name, role), every API key's hash, name, workspace, state, creation, expiry and last-used time, spend limit and usage, guardrails and their key assignments, the credit balance, and the 30-day activity per model and provider (requests, tokens, spend).
- Stored: the test results and their evidence, including the model usage summary, and the management key, encrypted at rest and never shown again after you save it.
- Not stored: key values (OpenRouter never returns them), and prompts or completions (never read).
- OpenRouter's API serves only the last 30 completed UTC days of activity; older activity is not available.
- No customer data goes to third-party LLMs from this integration.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
OpenRouter needs: management API key | The key field is empty | Paste the management key |
A 401 naming OpenRouter | The key was revoked, expired or mistyped | Create a new management key and paste it again |
A 403 naming OpenRouter | A normal (model) key was pasted, or the key's account is not an organization | Use a management key created by an Org Admin |
| An error asking for an attestation on data retention | A key runs under no guardrail that enforces zero data retention with training off; account-wide privacy settings are not readable through the API | Assign such a guardrail to the key, or upload an attestation of the account settings |
Rotation and disconnect
- Rotate: create a new management key in OpenRouter, open the connector under Compliance > Connectors, choose Edit, paste the new key and save, then delete the old key in OpenRouter.
- Disconnect: remove the connector under Compliance > Connectors, then delete the management key in OpenRouter.
Vendor references
- Management API keys, checked 2026-10-16.
- OpenRouter API reference (OpenAPI document), checked 2026-10-16.
- Get user activity grouped by endpoint, checked 2026-10-16.
Anthropic Claude Compliance
Connect your Claude organization's Activity Feed to Safeguard through Anthropic's Compliance API. The scope the key needs, which key types work, and step-by-step setup.
Kaggle Models
Connect Kaggle Models to Safeguard. The credential each connection needs, which Kaggle keys work, what Safeguard reads, and step-by-step setup.