OpenRouter API Production Checklist

Verify API Compatibility and Endpoints

Use the standard OpenAI-compatible endpoints for reliable integration.

The primary endpoint is POST /v1/chat/completions. This handles text generation for chat histories. A secondary endpoint, GET /v1/models, lists available models. You do not need embeddings or image generation endpoints for text-only tasks. Many developers assume they need a complex routing layer. OpenRouter simplifies this by exposing a single entry point. You send a JSON payload with your model ID and system prompts. The service returns structured JSON with content and usage data. This design matches the official OpenAI SDK expectations. You can swap models without changing your client code. Just update the model ID in your configuration. Ensure your client supports the latest JSON schema. Older versions might reject new parameters. Test your connection before deploying to production. Verify that the response format matches your parser.

Configure Authentication and Keys

Secure your API key in environment variables immediately after generation.

Generate a key through the provider dashboard. Store it in a secure location. Never hardcode it in your source repository. Pass it via the Authorization: Bearer <key> header. Each key is tied to a specific account. You can rotate keys if you suspect a leak. Some providers allow multiple keys per account. This allows you to separate development and production traffic. Monitor usage per key to detect anomalies. Revoke unused keys regularly. Use short-lived keys for temporary scripts. This reduces the blast radius of a compromise. Ensure your SDK version supports bearer token authentication. Older libraries might require a different header format. Check the documentation for your specific SDK. Verify that the key has sufficient balance. An expired key returns a 401 error. A key with zero balance returns a 402 error. Distinguish between these two states in your logic.

Handle Streaming and Token Usage

Enable streaming for lower latency and real-time user feedback.

Set stream: true in your request payload. The server sends a series of Server-Sent Events (SSE). Each event contains a partial chunk of text. You must assemble these chunks to form the full response. The final chunk often includes token usage statistics. This allows you to track costs in real-time. Without streaming, you wait for the entire response. This increases perceived latency significantly. Streaming is essential for chat interfaces. It creates a typing effect that feels responsive. Be careful with error handling during streaming. If the connection drops, you lose the current chunk. Reconnect logic should preserve the conversation state. Some SDKs handle streaming automatically. Others require manual event listeners. Choose the approach that fits your architecture. Ensure your parser handles incomplete JSON chunks. Do not assume each event is a complete object. Buffer the data until you have a valid structure.

Monitor Rate Limits and Concurrency

Track your requests per minute to avoid service interruptions.

OpenRouter enforces strict rate limits per API key. Exceeding these limits triggers a 429 Too Many Requests error. You must implement exponential backoff in your retry logic. Concurrent requests also count against your limits. Check the response headers for remaining quota. Some providers expose these headers directly. Others require you to infer limits from errors. High concurrency can exhaust your connection pool. Ensure your client manages connections efficiently. Use connection pooling to reduce overhead. Monitor your queue depth during peak loads. If you hit the limit, wait before retrying. Randomize your wait time to avoid thundering herd problems. Log all rate limit events for debugging. This helps identify patterns in your usage. Adjust your concurrency settings based on these logs. Do not assume a single key can handle unlimited traffic. Distribute load across multiple keys if necessary. This requires careful state management. Ensure each key maintains its own context if needed.

Manage Crypto Billing and Top-Ups

Use prepaid credit to cover token usage without monthly fees.

Top up your account with cryptocurrency. Supported networks include USDT on TRC20 and USDC on Base. Minimum top-ups start at $20. Bonuses apply for larger amounts. You receive 5% extra for $50, 10% for $100, and 15% for $200. Credit never expires. This is ideal for long-term projects. You only pay for actual tokens used. Errors and refusals are free. This protects your budget from unexpected costs. New accounts get $0.50 for testing. Refunds are not issued for standard purchases. Double charges are corrected via support. Ensure your wallet supports the required networks. Verify the contract address before sending. Incorrect networks may result in lost funds. Check your balance regularly. Low balances can interrupt service unexpectedly. Automate top-ups if possible. This ensures continuous availability for critical tasks.

Test Content Filters and Refusals

Verify that the model behaves as expected with uncensored prompts.

Uncensored models may still apply hard limits. Check for restrictions on specific content types. Test with known trigger phrases. Ensure the model responds appropriately. Some providers keep filters for legal reasons. Verify these before relying on the model for sensitive data. Test edge cases in your domain. Send prompts that typically trigger refusals. Observe the response format. Does it return a reason for refusal? Or does it generate content silently? Document these behaviors in your integration tests. This prevents surprises in production. If the model changes its behavior, update your tests. Notify your team of any significant shifts. Consistency is key for user trust. Ensure your application handles refusals gracefully. Do not assume every response is valid. Validate the output structure. Check for hallucinations or formatting errors. This ensures a reliable user experience.

Implement Error Handling for Free Requests

Handle errors gracefully to maintain a smooth user experience.

Network errors, timeouts, and server errors can occur. Implement retry logic with exponential backoff. Distinguish between transient and permanent errors. A 429 error is transient. Wait and retry. A 400 error is permanent. Check your input data. A 500 error is server-side. Retry with caution. Log all errors for debugging. Include the request payload and response body. This helps reproduce issues quickly. Do not expose raw errors to users. Format them into user-friendly messages. Handle streaming errors carefully. Disconnect from the event stream. Clean up resources. Ensure your application does not leak memory. Test error scenarios thoroughly. Simulate network drops. Simulate server timeouts. Verify that your recovery logic works. This ensures reliability under adverse conditions.

Scale with JSON Mode and Tool Calling

Use structured outputs for reliable data extraction and function execution.

Enable JSON mode by setting response_format: {type: "json_object"}. This forces the model to output valid JSON. Use this for parsing data or generating configs. Tool calling allows the model to execute functions. Define your tools in the request payload. The model decides when to call them. Pass the results back to the model. It can generate a final response based on the output. This creates a loop for complex tasks. Ensure your tool definitions are clear. Ambiguous tools lead to incorrect calls. Validate the JSON output before parsing. This prevents runtime errors in your code. Use tool calling for data extraction tasks. It improves accuracy significantly. Test with various input formats. Ensure the model handles edge cases. Document the available tools for your team. This ensures consistent usage across projects.

Review Privacy and Data Usage Policies

Understand how your data is stored and used by the provider.

Check the privacy policy for data retention details. Some providers use your data for training. Others keep it private. Ensure your data is not used for model improvement if that matters to you. Verify encryption standards. Data should be encrypted in transit and at rest. Check if logs are stored. Logs may contain your prompts. Ensure these logs are secure. Review the terms of service for liability clauses. Understand who owns the generated content. Some providers claim rights to your output. Ensure this aligns with your needs. Delete your account if you no longer use the service. Verify that your data is removed. Contact support if you have concerns. Document your privacy settings for audit purposes. This ensures compliance with internal policies.