Security Disclosure Recommendation: Check for Unexpected OpenRouter Usage

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

If you use OpenRouter with Railway, disable any API key that may have been exposed, review the Activity page for requests you didn't make, and redeploy your services with a new key.

If you have an OpenRouter API key that may have been exposed, or your credit balance dropped without a matching change in your traffic, check your OpenRouter usage. If a key leaked, it spends your prepaid credits directly. Whoever has it can also route requests to any model OpenRouter offers, which shows up as models you never use.

Disable the key

Disabling a key stops it immediately and keeps its history for review. Deleting is permanent. Your Railway services can't reach OpenRouter until you deploy the replacement key in the next section.

1. Open API keys in your OpenRouter settings and find the exposed key.
2. Optional: before you disable it, query the exposed key directly. The response includes usage, usage_daily, usage_weekly, and usage_monthly in credits, and limit_remaining if the key has a cap. See Limits.

   curl https://openrouter.ai/api/v1/key \
     -H "Authorization: Bearer $EXPOSED_OPENROUTER_KEY"
   

3. Disable the key. If you prefer to delete it, do that after the review below, because the key's usage fields disappear with it.
4. Create a replacement key with a spend limit and an expiration. OpenRouter shows it only once, so copy it now.
5. Optional: list, disable, or delete keys programmatically with a Management API key. See API key audit.

   curl "https://openrouter.ai/api/v1/keys?include_disabled=true" \
     -H "Authorization: Bearer $OPENROUTER_MANAGEMENT_KEY"
   

Update the key on Railway

On Railway, your OpenRouter key is a variable, so updating it means editing the variable and redeploying.

1. Open the service that uses the key and click Variables. If the key is a shared variable, edit it once in Project Settings and every service that references it gets the new value when you deploy.
2. Set the variable to the new key, then deploy the staged change.
3. Confirm the new deployment is active and its logs show successful requests to OpenRouter.

Review for misuse

The Activity page rolls every request up by model, provider, API key, app, and user.

1. Open Activity and set the date range to the exposure window. See Activity.
2. On Overview, check the top API keys and top apps. If you see a key or app name you don't recognize, that's likely the misuse.
3. On Explore, set the metric to spend, group by API key, and subgroup by model. Spend under the exposed key on models you never use is your unexpected spend.
4. Click View logs on a suspicious card to see the individual generations.
5. Export the Explore table as CSV before you delete anything. See Activity export.
6. Open Credits and check for purchases you didn't make, then check your organization members for people you didn't invite.
7. If you find usage you didn't generate, keep the export and contact OpenRouter support.

If you have any other questions, contact Railway support at support@railway.com.