Adding OpenRouter to Nango: why /v1/models accepts a fake key

Description and use

Added OpenRouter to Nango by selecting /v1/key as the verification endpoint, which correctly validates API keys, unlike /v1/models which always returns 200.

Problem

Nango needed a verification endpoint for OpenRouter to ensure API keys are valid before saving connections, but the common /v1/models endpoint returned 200 for fake or missing keys.

Outcome

By selecting /v1/key as the verification endpoint, Nango now correctly validates OpenRouter API keys, preventing invalid connections and reducing debugging time.

Workflow

• 1. Open Nango provider YAML and add OpenRouter configuration with API key auth and base URL.
• 2. Identify potential verification endpoint; test /v1/models with fake, real, and no key – all return 200.
• 3. Test /v1/key endpoint: fake key returns 401, no key returns 401, real key returns 200.
• 4. Set /v1/key as the verification endpoint in the YAML.
• 5. Run provider validation scripts and prettier checks to confirm YAML correctness.
• 6. Submit PR to Nango repository.
• 7. (Optional) Run full end-to-end Docker compose test and link checks.

Evidence

A fake key. 200. I tried again with a key that matches the real sk-or-v1- shape: 200. With no Authorization header at all: 200

Source

With my real key the same call returns 200. Fake key 401, no key 401, real key 200.

Source