Adding OpenRouter to Nango: why /v1/models accepts a fake key

说明与用途

在 Nango 中添加 OpenRouter 时，选择 /v1/key 作为验证端点，确保仅接受有效 API 密钥，而 /v1/models 总是返回 200。

问题

Nango needed a verification endpoint for OpenRouter to ensure API keys are valid before saving connections, but the common /v1/models endpoint returned 200 for fake or missing keys.

结果

By selecting /v1/key as the verification endpoint, Nango now correctly validates OpenRouter API keys, preventing invalid connections and reducing debugging time.

工作流

• 1. Open Nango provider YAML and add OpenRouter configuration with API key auth and base URL.
• 2. Identify potential verification endpoint; test /v1/models with fake, real, and no key – all return 200.
• 3. Test /v1/key endpoint: fake key returns 401, no key returns 401, real key returns 200.
• 4. Set /v1/key as the verification endpoint in the YAML.
• 5. Run provider validation scripts and prettier checks to confirm YAML correctness.
• 6. Submit PR to Nango repository.
• 7. (Optional) Run full end-to-end Docker compose test and link checks.

证据

A fake key. 200. I tried again with a key that matches the real sk-or-v1- shape: 200. With no Authorization header at all: 200

来源

With my real key the same call returns 200. Fake key 401, no key 401, real key 200.

来源