How your BYOK key is handled
Last updated: July 22, 2026
Encryption
Your OpenRouter key is encrypted with AES-256-GCM before it ever touches the database. The encryption key is derived from a server-side secret that never leaves our infrastructure - it is not stored alongside your data, and it is not something we can hand over separately from the ciphertext.
Storage
Only the encrypted value is stored, in the same managed Postgres database as the rest of your account data. There is no plaintext copy anywhere at rest - not in logs, not in backups, not in a cache.
When it's used
Your key is decrypted in memory only at the moment a chat request runs in BYOK mode, used to call OpenRouter directly, and discarded immediately after. It is never logged, never returned by any API response, and never sent anywhere besides OpenRouter itself.
What you see
Once saved, the Providers page only ever shows a masked placeholder and a "key set" status - the real value is never redisplayed, even to you. To change it, remove the old one and add a new one.
Removing your key
Click Remove on the Providers page at any time - this deletes the encrypted value outright. There is nothing left to decrypt afterward.
Contact
Questions about this: open an issue on the project's GitHub repository.