Compute keys

A compute key is a capped OpenRouter credential tied to your project's available compute. Once created, paste it into the CLI setup command shown on the key creation page — it is not retrievable after that.

The opub CLI is open source. It's also optional — a compute key works directly with any OpenRouter-compatible tool that can use opub's allowed model providers; running through the CLI adds session linking.

Use the key

Use the key in two ways:

1. As a Linked Session, which auto-starts your CLI agents to link spend to your project
2. Any other way, in an unlinked session

Linked session

Running through the opub CLI links your session to the project — donors can see that donated compute is actively being used.

Install and run setup from inside your repository:

curl -fsSL https://opub.dev/install.sh | sh
opub setup claude --project owner/repo --compute-key-id <id>
opub run claude

The key creation page shows the exact opub setup command pre-filled. The following surfaces support linked sessions:

• Claude Code — opub run claude
• Codex — opub run codex
• GitHub Copilot CLI — opub run copilot
• Vibe — opub run vibe
• OpenCode — opub run opencode
• Continue — opub run continue

The advanced configs section on the key creation page has raw OpenRouter headers and environment variables for custom setups.

Use directly

A compute key is a capped OpenRouter credential for work on the project. It can be used directly with compatible tools, but direct use is not linked to a local opub session.

curl https://openrouter.ai/api/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk-or-v1-xxxxxxxxxxxxxxxxxxxx" \
  -d '{
    "model": "anthropic/claude-sonnet-4.6",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

Wire it into any compatible tool or workflow, or bring it to any OpenRouter-compatible interface. Sessions used this way will not be linked.

Continue can also use OpenRouter directly, but linked Continue work should use opub setup continue and opub run continue so opub can inject the provider key and generated MCP config. A manual direct config looks like this:

name: opub direct
version: 0.0.1
schema: v1
models:
  - name: opub donated compute
    provider: openrouter
    model: openai/gpt-5.4-mini
    apiBase: https://openrouter.ai/api/v1
    apiKey: <paste-one-time-key>

That can fund IDE chat, agent mode, or headless checks such as cn -p "Review staged changes for obvious bugs" --silent, but it remains an unlinked direct-key workflow.

Revoke a key

Open My projects, find the key, and disable it. Disabling removes the credential from OpenRouter and marks the key disabled locally. The reserved balance that hasn't been spent is returned to the project balance and becomes available for a new key.

Revoke a key when:

• You no longer use that workflow or machine
• The credential may have been exposed
• You want to redistribute balance to a different key

Disabled keys remain visible in the dashboard for spend history, but the credential is permanently gone.

Key lifecycle

A key moves through the following states:

• Provisioning — created locally, credential not yet issued by the provider
• Active — credential issued, spend is flowing
• Disabled — revoked by you or automatically disabled by opub when the project balance reached zero

opub reconciles active keys against the provider periodically and caps the provider-side limit to match available balance. If the project balance drains completely, the key is disabled automatically and balance is returned.