OpenRouter

OpenRouter is a single API key that fronts hundreds of models from Anthropic, Google, Meta, Mistral, and more — with automatic fallback and cost routing.

Get an API key

Sign up at openrouter.ai and create a key under Keys.

Setup

pai create model-provider openrouter \
  --provider openrouter \
  --api-key sk-or-...

This stores your API key securely and creates a ModelProvider that covers every model in the OpenRouter catalogue.

Verify:

pai get model-providers
# NAME         PROVIDER     ENDPOINT   MAX/DAY   LAST USED   AGE
# openrouter   openrouter                        —           5s

Supported models

OpenRouter's catalogue changes constantly — browse all models at openrouter.ai/models. Use the full OpenRouter slug as the model portion after openrouter/.

Example model	Reference
Llama 3.1 70B Instruct	openrouter/meta-llama/llama-3.1-70b-instruct
Mistral Large	openrouter/mistralai/mistral-large
Gemma 2 27B	openrouter/google/gemma-2-27b-it
Claude 3 Haiku via OpenRouter	openrouter/anthropic/claude-3-haiku

Use in an agent

spec:
  models:
    - openrouter/meta-llama/llama-3.1-70b-instruct

Multiple models — first is primary, rest are fallbacks:

spec:
  models:
    - openrouter/anthropic/claude-3.5-sonnet         # primary
    - openrouter/meta-llama/llama-3.1-70b-instruct   # cheaper fallback

Token budgets

Cap how many tokens this subscription burns per day across every agent — a hard safety net against runaway spend.

apiVersion: pai.io/v1
kind: ModelProvider
metadata:
  name: openrouter
spec:
  provider: openrouter
  apiKeySecretRef:
    name: openrouter-key
    key: api-key
  maxTokensPerDay: 5000000      # daily cap shared across all agents
  maxTokensPerRequest: 200000   # per-request context-window limit

When the daily cap is hit, the gateway returns HTTP 429 until midnight UTC. Agents that list another provider in spec.models automatically fall over to it.

Expose via the LLM Gateway

Set externalAccess.enabled: true to let developers outside the cluster — laptops, CI, scripts — route their own LLM traffic through this provider. The OpenRouter API key stays inside Pai; clients authenticate with a Pai AccessKey instead.

spec:
  externalAccess:
    enabled: true
    maxTokensPerDay: 2000000    # separate budget for external usage

Once enabled, developers connect with three commands:

pai login https://api.pairun.dev --access-key pak_...
eval $(pai gateway env)
claude   # any OpenAI/Anthropic client now reaches OpenRouter through Pai

See LLM Gateway for the full onboarding flow, AccessKey management, and per-developer rate limits.

Access control

Narrow which models agents may call on this provider with allowedModels / deniedModels, or attach prompt-injection guards. See Security controls on the Model page for the full field list.