Manage and de-risk your API keys with new Security Center

OpenRouter has introduced Security Center, available under Settings > Security on all plan types, to help organizations inventory, assess, and reduce API key risk across workspaces. The tool emerged from an internal audit that found more than 1,000 active keys among 85 employees, including many unused, unlimited, or non-expiring keys. Its Overview highlights keys lacking spend limits or expiration dates and those idle for 90 days or more, while recommending actions such as archiving unused keys, setting spending caps, enabling alerts, and enforcing maximum lifetimes. The Key Safety tab centralizes active MCP and management keys with owner, usage, spending, and expiration information, assigning risk and usage labels to identify keys that are safe to remove, in use, or require review. Administrators can filter and update up to 500 keys at once, export recommendations as CSV files, and rely on metadata rather than prompt or completion content for analysis. Enterprise organization admins can also use the relocated IP allowlist to restrict all account keys to approved IPv4, IPv6, or CIDR network addresses, while OpenRouter recommends regular cleanup, offboarding checks, limits and expiration for every key, network restrictions for production keys, and periodic rotation of active credentials.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.