OpenRouter Security Center key sprawl: a Sume key checklist

For Sume keys, the hygiene pattern is: one key per integration, rotate by creating a replacement, verifying it with GET /v1/me, then revoking the old one, and cap paid MCP calls with max_spend_usd. Sume documents per-key request budgets by plan; this post does not claim other per-key controls.

OpenRouter's announcement (2026-09-28) describes a Security Center that lists every key and flags risk. Its reasoning is stated plainly: the fewer old keys you have, the fewer can leak. Sume facts are from Authentication and MCP tools and gates, read 2026-10-01.

What does OpenRouter's Security Center check?

From the announcement: the Overview counts keys with no spend limit, keys that never expire, and keys unused or idle for 90+ days, and lists recommendations such as removing unused keys and setting a spend limit, because a limit caps what a leaked key can spend. OpenRouter says it audited its own org and found over 1,000 active keys for 85 employees. Those are OpenRouter features and numbers; none of it describes Sume.

What does Sume document for key hygiene?

What are the per-minute budgets?

Writes and reads are counted separately. The plan number is the write budget, and reads get forty times that.

How do I run this as a checklist?

Give each integration its own key so you can revoke one without breaking the others. Name where each key lives. Rotate by replace, verify, revoke. Send exactly one credential per request, since Sume rejects both Authorization: Bearer and x-api-key together. For agents, set max_spend_usd on paid calls. If a key leaks, follow what to do with an exposed API key.