MarketDeck docs

openrouter

Manage the OpenRouter API key and probe its health — credentials read from STDIN, never argv.

marketdeck openrouter is the management surface for the OpenRouter AI provider. Unlike the CLI-based providers (claude, codex, hermes, openclaw, ollama) which delegate auth to their own vendor binary, OpenRouter is HTTPS-direct — marketdeck holds the API key in the keyring and presents it on every request via the Authorization: Bearer … header.

The key is never accepted on argv. set-key reads it from STDIN so it cannot leak through ps, /proc/<pid>/cmdline, or shell history.

Usage#

marketdeck openrouter <subcommand>

Subcommands#

Subcommand	What it does
`status`	Report whether a key is stored.
`set-key`	Read API key from STDIN and store it in the keyring.
`clear-key`	Wipe the stored API key.
`test`	Probe `/api/v1/auth/key` with the stored key.
`models`	List every model the key has access to.

Examples#

echo -n 'sk-or-v1-…' | marketdeck openrouter set-key
marketdeck openrouter status
marketdeck openrouter test
marketdeck secrets test --scope openrouter
marketdeck secrets rotate-plan --scope openrouter
marketdeck openrouter models | head -20
marketdeck openrouter clear-key

Storage#

The key lives in the keyring (libsecret on Linux, AES-GCM vault elsewhere) under scope openrouter, id api_key. Mirrors the storage pattern Telegram bot tokens use — see core/secret-openrouter.js for the read/write helpers.

Use marketdeck secrets for metadata-only OpenRouter diagnostics, export, rotation planning, and confirmed removal. marketdeck secrets never returns the API key value.

Run-time path#

When ai-enhance-provider is set to openrouter, the agent runtime dispatches via runDirect (defined in ai/providers/openrouter.js) instead of spawning a vendor CLI. The runtime helper runAiProvider in ai-runtime.js honours that hook automatically; no analysis-side code change is needed.

ai-enhance-model must also be set — pick a model id from marketdeck openrouter models (or from openrouter.ai/models) and store it via marketdeck config set ai-enhance-model <id>.

Optional GSettings keys honoured by the OpenRouter adapter:

Key	Effect
`ai-openrouter-temperature`	Sampling temperature passed to the model. Negative or unset → model default.
`ai-openrouter-max-tokens`	Cap on response tokens. `0` or unset → unlimited.

Security invariant#

Marketdeck does not put credentials on argv. See the providers security invariant for the full rule — adapters that accept secrets via stdin or env are the only acceptable shape.