Which OpenRouter key Glow needs, and how to make it safe

OpenRouter has two kinds of keys, and they do very different things.

• Inference keys (the normal API keys you put in your app) call models and spend credits. They can’t read your account’s activity.
• Management keys (also called provisioning keys) manage your account: list keys and their usage, read activity and credits, and create, edit or delete inference keys. They can’t call models.

Spend dashboards, Glow included, need a management key, because activity by model and key is only available to it. OpenRouter doesn’t offer a read-only management key, so it’s worth understanding the risk and how Glow limits it.

Create a management key

1. Sign in at openrouter.ai and open Settings → Management keys (openrouter.ai/settings/provisioning-keys).
2. Click Create and name it Glow (read-only use).
3. Copy the key; OpenRouter shows it once.
4. Paste it into Glow. Glow seals it immediately and never shows it again.
5. In Glow, name each inference key (“relay-prod”, “sprout-vision”) and assign it to a product.

How Glow makes it safe

• Glow’s outbound network rules allow only GET requests to three endpoints: /api/v1/activity, /api/v1/keys and /api/v1/credits. A request to create or delete a key is blocked before it leaves Glow.
• The key is sealed with envelope encryption, and the server that faces the internet can’t decrypt it.
• Glow labels the connection “not read-only” and asks you to confirm, so you know exactly what you handed over.
• Glow never uses your keys for inference. Ask Glow and agents run on Glow’s own OpenRouter account.

What you get

Thirty days of spend by model, key and product on day one, cache hit rate per key, $ per million tokens after caching, and swap suggestions ranked by GlowBench. Want prices first? See the model price index or the free models list.