Read this before you paste a live API key
- Your request, key included, is relayed through api-tester.com's server. Browsers block a web page from reading another origin's response unless that origin opts in, and OpenRouter's API does not opt in for arbitrary sites. A browser-based tester therefore has to hand the request to a server and return the result. Ours is that server, so your key passes through our infrastructure on the way to OpenRouter.
- Keys are not logged or stored by us. The credential signs the outbound request and is then gone; your request history stays in your own browser's local storage and is never uploaded. That is a commitment rather than something you can verify from outside, and you are entitled to treat it accordingly.
- Use a key with its own credit limit, not your main one. OpenRouter lets you cap what each key may spend when you create it; a low-limit key made for testing is the right thing to paste here.
- If you are unsure about a key, rotate it. Deleting a key and creating a replacement takes a minute. Any key you have pasted into a third-party tool and feel uneasy about should simply be replaced.
If none of this sits right for a particular credential, build the request here with the key field empty, press Copy as cURL, and add the key on your own machine. You get the exact request and the secret never leaves your laptop.
How to test an OpenRouter API key
1. Create a key
Keys are created in your OpenRouter account settings. Each one can be given a label and an optional credit limit, which is a ceiling on that key's spending regardless of the account balance.
2. Ask the API about the key
The request pre-filled above is a GET to https://openrouter.ai/api/v1/key. It
returns a description of the key that made the call. Do not use the models listing as your key check on
this API: /api/v1/models is public and returns 200 with no key at all, so a
successful response there proves nothing about your credential.
3. Send the key as a bearer token
The Auth tab is already set to Bearer token; paste the key into the field. It is sent
as Authorization: Bearer <key>, as the
bearer token guide describes.
4. Send and read the response
A 200 with a data object means the key is valid. The fields inside tell you
whether it can actually pay for a request.
Valid key vs invalid key: what you'll see
GET https://openrouter.ai/api/v1/key
Authorization: Bearer <your key>
200 OK → { "data": { "label": "…", "usage": …, "limit": …,
"limit_remaining": …, "is_free_tier": …, … } }
401 → { "error": { "code": 401, "message": "…" } }
usage is what the key has spent and limit is its cap, both in US dollars; a
limit of null means the key has no cap of its own and is bounded only by the
account's credit. limit_remaining is the figure to watch on a capped key, and
limit_reset says whether the cap renews on a schedule. is_free_tier marks a
free-tier key. The response also breaks usage down by day, week and month.
Notice the error format. error.code is a number that repeats the HTTP status, where
OpenAI's format puts a string such as invalid_api_key in that field. A client written for
OpenAI that switches on string codes will not match anything here.
Reading errors from a router
With a single-provider API, an error is about your request or about that provider. OpenRouter adds a layer: your request goes to OpenRouter, which chooses a provider for the model and forwards it. An error can come from either hop, and telling them apart decides what you do next.
| Status | Who is reporting | What to do |
|---|---|---|
| 400 | OpenRouter | Fix the request: invalid JSON, a missing field, or a model id that does not exist |
| 401 | OpenRouter | Fix the key |
| 402 | OpenRouter | Add credit, or raise the key's limit |
| 403 | OpenRouter | The key lacks permission, or the input was blocked by a guardrail or moderation |
| 408 | OpenRouter | The request timed out; retry |
| 429 | Either | Back off; free models have much tighter limits |
| 502 | The upstream provider | The chosen model is down or returned something invalid; retry or switch |
| 503 | OpenRouter | No provider currently meets the routing requirements of the request |
When the failure is upstream, the error.metadata object often carries the provider's name
and its raw error, which is the detail to put in a bug report.
An error inside a 200
HTTP sends the status line before the body. Once a model has started producing output, the status has
already gone out as 200, and a failure after that point cannot change it. OpenRouter
reports such a failure as an error object in the response body, or as an error event in
the stream. A client that checks only response.ok will treat a half-finished generation as
a success. Check for a top-level error field, and check each choice's
finish_reason, before using the text.
Sending a chat request
POST https://openrouter.ai/api/v1/chat/completions
Authorization: Bearer <your key>
Content-Type: application/json
{
"model": "<vendor/model-id-from-the-models-list>",
"messages": [
{ "role": "user", "content": "Say hello." }
]
}
Model identifiers on OpenRouter have two parts, a vendor and a model name joined by a slash. Copy one
from the GET /api/v1/models response rather than typing it from memory; the id a provider
uses on its own API is usually not the id OpenRouter uses for the same model. The catalogue also lists
each model's context length and pricing, so that listing, not this page, is where to look for numbers.
To run the call, pick the chat endpoint from the list beside the console, add
Content-Type: application/json in the Headers tab and paste the body into the Body tab.
This console waits 30 seconds and shows one completed response, so leave streaming off.
The optional attribution headers
HTTP-Referer and X-OpenRouter-Title tell OpenRouter which application a
request came from, for its public usage rankings; older examples call the second one
X-Title. They are optional and have no effect on authentication. If a request works here
without them and fails in your app, they are not the cause.
Using an OpenAI SDK
Set the base URL to https://openrouter.ai/api/v1 and supply the OpenRouter key. The request
format is OpenAI's; the model id and the error format are OpenRouter's own.
Provider APIs change — check the official docs
api-tester.com is an independent tool with no affiliation to, partnership with or endorsement from OpenRouter. Nothing here is official documentation. Endpoints, model names, error wording and limits are the provider's to change, and this page can fall behind. For current and authoritative detail, consult the official OpenRouter documentation.
We have deliberately not quoted prices, rate limits or model identifiers. Those change fastest, and OpenRouter's own models endpoint returns them live. What this page describes is the durable shape of the API: how it authenticates, how its errors are structured, and which hop an error came from.
Test other providers and related tools
OpenAI API Tester
Bearer authentication, the models endpoint, and why 429 covers two different problems.
Anthropic API Tester
Test a Claude API key, including the version header the API requires.
Groq API Tester
The /openai/v1 base path and the rate-limit headers on every response.
DeepSeek API Tester
Check a key and its balance, and tell a 402 from a 429.
API Key Tester
A generic checker for any API key, whatever the authentication scheme.
API Rate Limiting
How limits are counted, and how to back off and retry.
Frequently asked questions
How do I test whether my OpenRouter API key is valid?
Send a GET request to https://openrouter.ai/api/v1/key with the key in an Authorization header using the Bearer scheme. A valid key returns 200 and a JSON object with its label, usage and limit. Do not use the models endpoint for this check, because it responds without any key.
How do I check how much credit my OpenRouter key has left?
The same /api/v1/key request returns usage, limit and limit_remaining for the key. A limit of null means the key has no cap of its own and draws on the account's credit.
What does a 402 error from OpenRouter mean?
Insufficient credit. Either the account balance is exhausted or the key has reached the credit limit set on it. Retrying will not help until credit is added or the limit is raised.
Why did I get an error with a 200 status?
Because the failure happened after the model had begun responding, when the status line had already been sent. OpenRouter then reports the problem as an error object in the body or the stream. Always check the body for an error field.
Does my API key pass through your server?
Yes. Browsers block cross-origin reads, so the request is forwarded through api-tester.com's server, which means your key transits our infrastructure on the way to OpenRouter. We do not log or store keys, but you should use a key with a low credit limit and delete it afterwards. To keep the secret local, build the request here without a key, copy it as cURL and add the key on your own machine.
Is this tool affiliated with OpenRouter?
No. api-tester.com is an independent HTTP request console with no affiliation to, partnership with or endorsement from OpenRouter. Check the official OpenRouter documentation for current endpoints and behaviour.