The Switchboard: OpenRouter, Explained

A model and a host are two choices

OpenRouter's most useful trick is turning one decision into two. You choose a model; it chooses, or lets you choose, the company that runs it. Its quickstart says it in two sentences: "OpenRouter gives you access to hundreds of AI models through a single API endpoint. It handles fallbacks automatically and picks the most cost-effective option for each request."

Three products hide in those sentences. A catalog: on 19 October the public model list held 470 text entries, about 350 of them distinct models once batch, free and alias copies are set aside, from some 55 publishers (685 entries counting image, video, speech, embedding and other models). A router: popular models are served by several inference providers (the providers API listed 112 entries), and OpenRouter decides which one gets each request and retries elsewhere when one fails. And a bill: one balance and one invoice instead of an account with every lab and every host.

What it is not: a model lab or a host. Unless you call one of its routers, it does not pick your model, and it does not run it. It does not replace a coding agent either: permissions, shells, reviews and tests stay where they are. It sits between your code and the hosts, which is why its routing, pricing and data rules deserve more attention than its marketing.

Who runs it

OpenRouter started in April 2023 as Window, a Chrome extension for using several models at once, and took its current name that August, according to its lead Series A investor, Menlo Ventures. The founders are Alex Atallah, previously a co-founder of the NFT marketplace OpenSea, and Louis Vichy; Menlo also counts COO Chris Clark as a co-founder, and all three signed the acquisition post. It is based in New York and called itself a "90-person startup" in August.

The scale claims grew with the money: "10+ trillion tokens per day" in the acquisition post, "600T+ Monthly tokens" and "10M+ Global users" on the about page today. They are company figures, not audits, and each host counts tokens with its own tokenizer.

OpenRouter's promise for the Stripe era is explicit: "same mission, same name, same product, same roadmap", a commitment to "every model on equal footing" that "doesn't bend to any model, any provider, or any parent company", and routing "driven by one thing: what's best for you, the user." A PitchBook analyst quoted by TechCrunch sees the other side: the deal gives Stripe "some degree of power over suppliers such as the frontier labs themselves". Both can be true. The practical point: the switchboard is getting an owner with its own strategy, and the privacy policy already allows personal data to pass "to a buyer or other successor" in a sale.

How a request travels

The API is OpenAI's Chat Completions format at a different address. OpenRouter "normalizes the schema across models and providers so you only need to learn one" and calls itself "a drop-in replacement for OpenAI": an OpenAI SDK pointed at https://openrouter.ai/api/v1 sends Chat Completions requests unchanged.

curl https://openrouter.ai/api/v1/chat/completions \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "X-OpenRouter-Metadata: enabled" \
  -d '{
    "model": "z-ai/glm-5.3",
    "messages": [{"role": "user", "content": "Explain a race condition in one paragraph."}],
    "provider": {"zdr": true, "quantizations": ["fp8", "bf16"]}
  }'

On 19 October, 12 of GLM-5.3's zero-data-retention endpoints ran at fp8, Z.AI's own among them, so this request has somewhere to go. Here is what happens to it.

• The model ID picks the model: publisher/model, optionally with a suffix (next section).
• The router picks the host. The documented default puts providers with "significant outages in the last 30 seconds" last, then chooses among the cheapest, "weighted by inverse square of the price", and keeps the rest as fallbacks: a host at twice the price gets a quarter of the weight. A provider-facing page describes a richer model (traffic shares from cache-adjusted price, time to first token, reliability, rate limits and speed, with breakers and caps), and for any request that carries tools, Auto Exacto reorders hosts by tool-calling quality first. Cheap and healthy wins, unless you say otherwise.
• Your provider block narrows the choice. Here: only endpoints with zero data retention, only fp8 or bf16 weights.
• Failures fall through, at two levels. A server error or a rate limit sends the request to another host of the same model; a models array falls through to other models, and "Requests are priced using the model that was ultimately used". A fallback can change more than availability: the reasoning behavior, the context limit, the price and the company that reads your prompt. "An attempt that errors is not charged for its model tokens."
• The answer comes back normalized, with a usage object on every response: token counts from the model's own tokenizer, cached and reasoning tokens, and cost, "the total amount charged to your account". The metadata header adds openrouter_metadata: the endpoint that was selected, from which candidates, on which attempt.

Every response also carries an X-Generation-Id header, and GET /api/v1/generation?id=… returns the record later, including provider_name and every fallback attempt. When a model answers badly, that is how you find out which endpoint served it.

Two more doors lead to the same router. /api/v1/responses mirrors OpenAI's Responses API (generally available since 25 July 2026) but is stateless: "Requests that set store: true or a non-null previous_response_id are rejected with a 400 error." And /api/v1/messages speaks Anthropic's Messages format, which is how Claude Code connects. Compatibility means a large common interface, not that every native workflow survives a change of base URL.

The catalog: 470 entries, and how to name one

The biggest shelves on 19 October were OpenAI (104 entries), Google (44), Qwen (43), Anthropic (30), Mistral (26) and Z.ai (18). These are catalog entries, variants and routers included, not separately trained models, and a capability in the metadata is not a promise from every host. Of the 470 text entries:

Around the plain publisher/model IDs the catalog has grown its own grammar. Variants come in two kinds: catalog variants with their own entries, and routing variants accepted on any model.

• :free copies cost nothing and come with tight limits: 20 requests a minute and 50 a day, 1,000 once the account has bought $10 of credits. A suffix that does not exist fails instead of quietly using the paid model, but a fallback from a free model to a paid one is billed.
• :batch twins cost about half and run through the Batch API within 24 hours. anthropic/claude-opus-5.5:batch lists at $2 and $10 per million tokens against $4 and $20.
• :nitro sorts by throughput and admits priority-tier endpoints, which cost more: not a free speed upgrade. :floor sorts by price and admits flex-tier endpoints. :exacto sorts by tool-calling quality. :online, :thinking and :extended are deprecated.
• ~ aliases follow a family. ~anthropic/claude-opus-latest "always redirects to the latest model in the Claude Opus family", and the docs say these slugs "trade exactness for continuity": they even remap reasoning settings the new model does not support. Handy in a chat app, dangerous in a pipeline.
• Routers are models too. openrouter/auto classifies each prompt into one of about 30 task types and picks from what the community spent on for that type over the last seven days. openrouter/free picks a free model at random. openrouter/pareto-code picks the cheapest coding model above a quality bar you set. openrouter/fusion runs a panel of models and an analyst, "roughly 4–5× the cost of a single completion". Auto, Free and Pareto add no fee of their own; Fusion bills every panel and analyst call, web searches included.
• Service tiers show up as separate endpoints. GPT-6 Astra had seven: OpenAI's flex tier at $5 and $25 per million tokens, standard at $10 and $50, fast at $20 and $100, ultrafast at $60 and $300, plus Azure and Bedrock. You are billed at the tier that served you, and the response says which.
• Models expire. 19 entries carried an expiration_date on 19 October; a deprecated model returns 404. Pinning a model also does not pin its price.

The catalog moves fast: 57 entries were created in the 30 days to 19 October.

Same model, twenty prices

The catalog shows one price per model, "from the top provider". The endpoints API shows the market underneath. On 19 October, qwen/qwen3.8-27b, the model my Mac runs as its coder, had 20 endpoints:

Popular models spread further. GLM-5.3 had 46 endpoints at fp4, fp8, nvfp4 and undisclosed precision, with input from $0.055 to $2.80 per million tokens; Z.AI's own endpoint charged $1.40 and $4.40 at fp8. Kimi K3 had 26, 16 of them at 4-bit, Moonshot's own included; most of the rest did not disclose a precision. The docs warn that "Quantized models may exhibit degraded performance for certain prompts", and the price-weighted default will happily send you to the cheapest endpoint.

The provider object is how you take control:

Two details bite in agent loops. Unsupported parameters are dropped silently unless require_parameters is set, so a seed or top_k can vanish on the wrong endpoint; only tools, response_format and verbosity steer routing by default. And host stickiness, which keeps a prompt cache warm, expires "after 10 minutes of inactivity", while Auto Exacto can reorder hosts on any tool call, which the docs admit "can cause cache misses mid-conversation".

Quality is not uniform either

The same open model does not behave the same everywhere. Moonshot built a public vendor verifier after seeing "significant differences in the toolcall performance" across hosts of its Kimi models: in its November 2025 run, vendors reached through OpenRouter scored between 83.05% and 96.46% on tool-call schema accuracy, against 100% on Moonshot's own API. A researcher's LessWrong post carries the plain title "Not Pinning Your OpenRouter Provider Might Invalidate Your Research".

OpenRouter's answer is quality routing. Exacto (October 2025) and Auto Exacto (March 2026, on by default for any request with tools) rank hosts on live tool-call telemetry and benchmarks, and OpenRouter reports GLM tool-call error rates falling from "approximately 8%" to "closer to 1%". Its diagnosis cuts against the usual suspicion: "We haven't seen a measurable impact on tool-call quality from quantization alone. The actual culprit, more often than not: tool-call parsers."

So pin the host when results matter, and test your own task on it. Precision is one variable to pin; the serving stack behind it is the other.

What it costs

The pricing page answers the first question directly: "Inference is billed at the provider's list price on every plan. OpenRouter's fee is charged when you buy credits, 5.5% on Standard and 8% on Business, never on individual requests."

Three costs are easy to miss. Reasoning tokens "are considered output tokens and charged accordingly", even when exclude: true hides them. A price change applies to a model you already use: "we will continue to route to the model and it will serve your requests. But, you will be charged at the new rate". And prompt caching is priced per host. The docs' rule of thumb for Anthropic models is a cache write at 1.25 times the input price (2 times for the one-hour cache) and a read at 0.1 times; OpenAI charges 1.25 times for writes from GPT-5.6 on. The newest models differ: Claude Opus 5.5 and Sonnet 5.5 listed cache reads at a twentieth of their input price. Read the endpoint's own cache prices, not a rule of thumb.

Two worked examples

A review call. A 120,000-token article plus instructions, 6,000 tokens of answer, sent to Gemini 4 Argon at $2 input and $10 output per million: $0.24 + $0.06 = $0.30. If the model also thinks for 20,000 tokens, those bill as output: $0.50.

A long agent session. My assumptions, not a measurement: 150 model calls, an average prompt of 80,000 tokens with 90% served from cache, and 2,000 output tokens per call, reasoning included. That is 10.8 million cached input tokens, 1.2 million fresh ones (billed at the cache-write price where the endpoint lists one) and 0.3 million output tokens. At each lab's own endpoint on 19 October, before the 5.5% credit fee:

The spread is about fifty to one between the first and last row, for models that score 53 and 46 on the same intelligence index. Token price is not cost per finished task: a cheaper model that needs more attempts, more reasoning or more human repair can lose the comparison. For scale, OpenRouter's rankings page publishes the median paid cost of real coding-agent sessions over the last 30 days. In Claude Code, its "long" sessions cost about $9.09 on Claude Opus 5.5, $4.94 on Kimi K3, $2.68 on GLM-5.3 and $0.52 on MiMo-V2.6-Pro; in Codex, $16.78 on GPT-6 Astra (the page does not define its session buckets). My example costs more than those published medians, with a similar spread between models. Under my assumptions, five Opus 5.5 sessions a day would cost about $71 before the credit fee. For a workload like mine, that is why heavy daily work stays on flat-rate subscriptions and pay-per-token frontier access stays an emergency exit.

What happens to your prompts

Three parties can touch a prompt: OpenRouter, the host that runs the model, and any tool you switch on, such as web search. A setting at one layer does not bind the others.

OpenRouter itself keeps metadata, not content, by default: "We log basic request metadata (timestamps, model used, token counts). Prompt and completion are not logged by default." Its privacy policy adds: "OpenRouter does not use your Inputs or Outputs for model training." No logging is not no processing: it categorizes a small sample of prompts for its rankings, and safety classifiers can run on prompts in memory. Storing content is opt-in, through two separate switches: private input and output logging for your own debugging (kept "for a minimum of 3 months", and visible to organization admins for every member's requests), and "OpenRouter Use of Inputs/Outputs", which buys a 1% discount. Read section 6.2 of the terms before flipping either: whoever has "opted into prompt logging" grants OpenRouter "a worldwide, perpetual, irrevocable" license "for our own commercial and business purposes", including the right to "license or sell your User Content in anonymized form". The docs say OpenRouter "does not access or use" the private-logging data; the terms do not say which switch the clause means. For a 1% discount, I would leave both off.

The host that runs the model is the bigger variable. OpenRouter publishes a data policy per provider and calls it "not a definitive source of third party data policies, but represents our best knowledge." In its public provider data on 19 October, 94 providers carried a policy: 4 were marked as training on prompts (DeepSeek, Thinking Machines, NVIDIA and Liquid) and 38 as retaining them, Anthropic for 30 days and Google AI Studio for 55. OpenRouter's own June 2026 guide to open models notes that DeepSeek's first-party API "routes data through China, with a ToS that permits training on your data". The privacy policy states the limit plainly: "OpenRouter cannot control Model Provider-side training once user data is transmitted to a training-permitted Model Provider."

So the controls matter:

Zero data retention is the strongest switch, and it has fine print:

• It changes who serves the big labs. Enforcing it removes first-party Anthropic and OpenAI endpoints and Google AI Studio: Claude keeps running on Bedrock and Vertex, GPT on Azure, Gemini on Vertex. On 19 October the public ZDR list held 1,033 endpoints from 64 providers.
• It covers inference, not tools. "It does not apply to plugins and tools you choose to enable, such as web search."
• Caching is not "retaining". "OpenRouter has taken the stance that in-memory caching of prompts is not considered "retaining" data".
• It is a list, not a guarantee. The data processing agreement says ZDR eligibility "does not constitute OpenRouter's guarantee of AI Model Provider compliance."
• Classifiers still run. "Prompts may therefore be flagged by classifiers even with full ZDR configured."

Some features store content on purpose: batch inputs and results for 30 days, uploaded files until you delete them, cached responses for their time to live, and Broadcast traces wherever you send them, unless a destination's privacy mode strips the prompts.

Free models deserve their own warning. Of the 24 :free endpoints on 19 October, 13 ran on providers that OpenRouter's own provider data marks as training on prompts. Free "stealth" models, unreleased models that labs test under code names, are free for a reason the stealth terms spell out: if the listing says so, "your User Content will be logged in full and retained by the Stealth Provider for Stealth Model Training."

Moderation is the last layer. 139 of the 470 text entries carried is_moderated: true on 19 October, 121 of them OpenAI and Anthropic and the rest Meta, Cohere, Amazon and Writer; a flagged request returns 403 with the offending text in the error. The terms also forbid red-teaming models without written approval, and the red-teaming guide warns of "Platform-wide account bans". Whatever "uncensored" means to you, it does not mean a hosted endpoint on someone else's terms.

The paperwork exists: a data processing agreement with Standard Contractual Clauses and breach notice within 72 hours, and a SOC 2 Type II claim on the enterprise page and trust center, with the report itself behind an access request. I found no ISO 27001 claim.

The rest of the toolbox

Most of what follows is one parameter or one header away. All of it is documented; some of it is beta.

Three details are worth knowing before production. The API has one version, v1, and "Non-breaking changes ship without prior notice." Paid models have no plan-based rate limit: "A limit you hit there normally comes from the provider, and fallback routing retries other providers automatically". And once part of a streamed answer has reached you, there is no failover: "Failover also stops once part of the answer has reached you."

Plugging in coding agents

All three agents in my harness can talk to OpenRouter. "Can" hides a lot, so here is what each route really involves, from each side's own documentation.

Claude Code connects through OpenRouter's Anthropic-compatible endpoint. OpenRouter's guide sets four variables and asks you to /logout of any cached Claude login first:

export ANTHROPIC_BASE_URL="https://openrouter.ai/api"
export ANTHROPIC_AUTH_TOKEN="$OPENROUTER_API_KEY"
export ANTHROPIC_API_KEY=""   # "Must be explicitly empty"
export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1   # optional model picker

The fine print comes from both sides. OpenRouter: "Claude Code with OpenRouter is only guaranteed to work with the Anthropic first-party provider", which is exactly the endpoint that zero data retention removes. Anthropic's own gateway documentation: it "doesn't support routing Claude Code to non-Claude models through any gateway", and while a gateway credential is active, "requests carry that credential in place of a developer's claude.ai subscription login, and the subscription's usage limits don't apply to them". You pay per token instead. Remote Control and voice dictation switch off. Prompt caching survives only if the gateway forwards cache_control unchanged; otherwise "the conversation bills as uncached input on every turn". OpenRouter's guide adds ANTHROPIC_DEFAULT_*_MODEL overrides with a [1m] suffix, because "Claude Code assumes a 200k context window unless the model name ends in [1m]"; Anthropic's model-config page applies that default to model IDs it does not recognize, such as gateway aliases.

Codex speaks only the Responses API now: in its config reference, wire_api says "responses is the only supported value", after Chat Completions support was removed in February 2026. OpenRouter's Codex CLI recipe defines a custom provider and fetches the key through a command, because with a plain env_key "Codex won't fetch the OpenRouter model catalog":

model_provider = "openrouter"
model_reasoning_effort = "high"
model="~openai/gpt-sol-latest"

[model_providers.openrouter]
name = "openrouter"
base_url="https://openrouter.ai/api/v1"

[model_providers.openrouter.auth]
command = "sh"
args = ["-c", "echo $OPENROUTER_API_KEY"]

That is the guide's snippet as published; for anything you want to reproduce, put a concrete model ID where the ~latest alias is.

OpenRouter's Responses API is stateless and rejects store: true and previous_response_id. I did not test whether current Codex sends either; Codex's own tracker has open issues with third-party Responses providers, such as resuming a session that contains a compaction item.

OpenCode has OpenRouter built in: /connect, search for OpenRouter, paste the key, then /models. Model IDs become openrouter/<slug>, and routing preferences go per model under options.provider, as in OpenCode's own example:

{
  "provider": {
    "openrouter": {
      "models": {
        "moonshotai/kimi-k2": {
          "options": { "provider": { "order": ["baseten"], "allow_fallbacks": false } }
        }
      }
    }
  }
}

OpenCode's issue tracker had 196 items with "openrouter" in the title on 19 October. One report, closed as not planned, is a reminder of the "200 hides a failure" edge: an upstream error for GLM-5.3-Flash came back as a normal assistant message, "billed, no failover".

Everything else is a setting away. Aider takes --model openrouter/<provider>/<model> with OPENROUTER_API_KEY. Cline has OpenRouter in its API provider list. Cursor's "Override OpenAI Base URL" works with a dedicated https://openrouter.ai/api/v1/cursor endpoint (beta), although tab completions always use Cursor's own models. OpenRouter also ships Ori, a launcher that runs existing agent CLIs on OpenRouter (ori codex, ori opencode, ori cline and others; its Claude Code setup "isn't available yet"), and a hosted MCP server any of these agents can add to read OpenRouter's docs and model data.

What the traffic says

OpenRouter sits on one of the few public views of what developers actually run, and publishes much of it on its rankings page under CC BY 4.0. Read the units first: the top-models chart counts tokens, the market-share chart counts requests, the task view ranks by spend unless you switch it to tokens, and the app list includes only apps that opt in. In the page's own words, "a higher token total shows how much a model is used, not which model is best for a task."

With that caveat, the October 2026 picture:

• Open weights won the volume. In the public data behind the open-versus-closed chart, open-weight models handled 26.1% of tokens in the week of 20 October 2025 and 72.0% in the week of 12 October 2026, while weekly volume grew from 4.87 to 164.0 trillion tokens (my arithmetic; the chart excludes stealth models).
• Chinese labs lead that volume. The weekly top five to 18 October were DeepSeek V4.1 Flash (32.8T tokens), GLM 5.3 Flash, Step 5 Preview, MiMo-V2.6-Flash and Hy4 preview. Claude Opus 5.5 was seventh, with 6.18T.
• Money and volume crown different models. In the largest coding category over 30 days, the leaders by spend were Claude Opus 5.5 (13.1%), GPT-6 Astra (10.0%) and Kimi K3 (8.7%); by tokens, DeepSeek V4.1 Flash (21.6%), a free stealth model (13.2%) and GLM 5.3 Flash (10.1%).
• Agents are the customers. Among apps that opt into tracking, the top two for the week were Hermes Agent (13.07T tokens) and Claude Code (11.29T), ahead of Kilo Code, Cline and pi; Codex was tenth.

The longer view is the State of AI study a16z and OpenRouter published in December 2025, built from metadata on more than 100 trillion tokens ("we did not have access to the underlying text of prompts or completions"). Programming grew from "roughly 11% of total token volume in early 2025" to more than half. Claude held "more than 60% of programming-related spend for most of the observed period". Models that reason before answering went from almost nothing to more than half of all tokens, and the average prompt quadrupled, "from around 1.5K to over 6K". The study names its own limit: one platform, which leaves out "enterprise usage, locally hosted deployments, or closed internal systems."

Stealth launches are part of the traffic. Labs test unreleased models on OpenRouter under code names, free and often logged. The record includes Quasar Alpha and Optimus Alpha (OpenAI's GPT-4.1), Sonoma (xAI's Grok 4 Fast), Pony Alpha (Z.ai's GLM-5) and Ox Alpha, revealed as GLM-5.3-Flash, which Bloomberg called the biggest launch in the marketplace's history, according to The Next Web. A free stealth model was the second-largest model by tokens over the last 30 days.

Use all of this to decide what to test next, never as a substitute for testing. Even the Auto Router's choices come from what the community spends, which is popularity, not proof.

Sharp edges

Every row comes from OpenRouter's own docs or its live data, or from the reports cited above.

Two more deserve a sentence each. The gateway itself is a dependency: in February 2026 two outages of 38 and 35 minutes, caused by a third-party caching dependency, failed 80 to 90% of requests at the worst point of the first and approached total downtime in the second, with misleading 401 errors that sent customers debugging their own keys. Healthy hosts cannot help when the gateway cannot authorize the request; anything that must not stop needs a direct-provider fallback. And the docs are written for agents too: the Markdown copies that AI tools read contain a block the web page never shows, "For all code samples and guidance use OpenRouter SDKs by default". Harmless, and a reminder that your coding assistant reads instructions you do not.

Alternatives

OpenRouter calls itself "the largest and most popular AI gateway"; it is also one of a crowded field, and the field is consolidating: Palo Alto Networks closed its purchase of Portkey in May 2026, and Nvidia agreed in September to buy Hugging Face, which runs its own router. Choose the layer you need:

Two traps in this table. Self-hosting a gateway controls the gateway, not the inference: LiteLLM in your own cluster still forwards prompts to whatever cloud host you configure. And avoiding OpenRouter does not by itself improve privacy: Together, for example, stores prompts unless an organization enables zero data retention, while Fireworks says it does not log open-model data without opt-in. Compare the exact service and setting.

OpenRouter's edge is breadth plus routing: hundreds of models, failover across hosts, quality routing and public data about its own traffic. Its costs are the fee, a third party in the data path, and a catalog that moves under you.

Where it fits my harness

My harness runs three providers. Claude Code and Codex do the work on flat-rate subscriptions, and each reviews the other's work. A third agent, OpenCode on open-weight models, runs on this Mac for two jobs: uncensored work that never leaves the machine, and work that has to continue when both subscriptions hit their limits (The Third Mind tells that story). The local lane is locked on purpose: OpenCode's model requests may only go to the loopback model server, a request guard refuses any other model call before a byte leaves, and the shared policy says "Never enable a remote or paid provider in OpenCode without an explicit user decision."

So nothing below is switched on. It is what I would build if I said yes, in order of value per unit of risk.

The gap it fills

The local lane is honest about its limits. Two independent boards, read on 19 October, show a tier between it and the frontier: the Artificial Analysis Intelligence Index, and Vals' Terminal-Bench 2.1, an agentic coding benchmark run in a terminal (archived since 28 September, so it misses the newest builds).

The boards disagree on the order inside each tier (Gemini 4 Argon ties GPT-6 Astra on the index and trails the 27B on Terminal-Bench), but both place these four large open models above Qwen3.8-27B. On Terminal-Bench, the closer of the two to agentic coding, they beat it by 9 to 22 points, and Kimi K3 sits within seven points of Opus 5.5.

The middle row is why OpenRouter interests me at all. Those models publish their weights, but they run from several hundred billion to trillions of parameters (the survey behind my local lineup put Kimi K3 at about 2.8 trillion). They do not fit this laptop at any useful precision. OpenRouter offers all of them under zero data retention if you ask; on the long session in the cost section, MiMo-V2.6-Pro costs $0.82 and Kimi K3 $11.34 at their labs' own endpoints. Size is not a guarantee, though: MiniMax-M3, also too big for the Mac, scored 29 on the index.

Five ways it could plug in, ranked

1. A discovery feed, with no account at all. The model list is public JSON: 177 entries carry a hugging_face_id, every entry a creation date, some an expiry date. My nightly updater discovers local models through hand-written family rules on Hugging Face. A weekly diff of OpenRouter's catalog would surface families those rules do not know yet (XingChen's Xing4.0-29B-A4B, small enough for the Mac, entered the catalog on 16 October; its weights have been on Hugging Face since 16 September) and propose a rule for me to approve. Cost: one GET request. No prompts or code leave the machine.

2. Screening a candidate before downloading it. A new local candidate costs a download of up to 100 GB and an acceptance evaluation that took 27 to 71 minutes in my receipts, before the updater knows whether it is any good. Most of those families are also on OpenRouter. Running the tool, code and context suites against a pinned endpoint of disclosed precision, the lab's own where possible, could flag a weak model in minutes. It is a screen, not a verdict: a host's serving stack can sink a good model, so a failure on the lab's own endpoint is the strong signal, and a pass still has to earn the download and the local gates. The suites are synthetic tasks, so nothing private leaves, and the refusal probe stays local, well clear of the red-teaming clause.

3. A third reviewer when Codex is out. The default review route crosses providers: Claude's work goes to Codex and the other way round. When the other provider is limited, the fallback is a fresh child of the same provider: independent, but not cross-provider. Historical receipts show how often Codex was unavailable on the smaller plan it had then: in the four weeks before I cut Grok, it failed 128 of the 214 runs where it was tried first, almost always on its usage limit (I Fired My Busiest AI Reviewer); whether its larger plan lowers that is not yet measured. Pay-per-call changes the math of a third reviewer. A 120,000-token review on Gemini 4 Argon, which ties GPT-6 Astra on the index (it trails on Terminal-Bench, but a review is reading and judging, not driving a terminal), costs about $0.30; covering that many calls would cost tens of dollars a month, before reasoning tokens and the credit fee. I would send the review as a plain API request with no tools and no server-side plugins, which is simpler to isolate than a CLI child, and under zero data retention it runs on Google's Vertex endpoints. What the receipts cannot show is whether a third lab finds what the same-provider fallback misses. So it starts in shadow: both reviews run, I compare the findings, and it earns its place only if it catches things.

4. A middle lane for hard work when both subscriptions are out. This is the change that matters, and the one that needs the most care. Today, when Claude and Codex are both limited, hard work waits or goes to the local 27B. Kimi K3, DeepSeek V4.1 Flash and GLM-5.3 scored 71 to 81% in Vals' Terminal-Bench runs against Qwen3.8-27B's 58%, and cost $5.81 (GLM-5.3) to $11.34 (Kimi K3) on the long session in the cost table. Whether that advantage carries over to my tasks, and which of them earns the lane, is exactly what my own gates should decide. It would be its own launcher with its own guard, never a switch inside the local one.

5. Frontier models by the token. Opus 5.5 and GPT-6 Astra are both on OpenRouter. For a deadline that cannot wait for a reset, paying per token works, through the same separate cloud launcher rather than by pointing Claude Code or Codex at OpenRouter. It is the last resort: the long session in the cost section costs $14 to $41 on those two before the credit fee. Under the zero data retention this launcher requires, Claude would run on Bedrock or Vertex and GPT on Azure; their global endpoints listed the same prices on 19 October, and the regional ones 10% more.

What stays out

• Uncensored and local-only work. Its whole point is that nothing leaves the machine. Hosted endpoints add moderation on many models, and the terms forbid red-teaming without written approval.
• Client code and client data, unless that client's agreement allows both OpenRouter and the host serving the request. Zero data retention limits what a host keeps; it does not make the host disappear.
• Claude Code and Codex pointed at OpenRouter. Both would trade a subscription for metered tokens. Claude Code would need an OpenRouter key in ANTHROPIC_AUTH_TOKEN, a variable my harness never sets, plus a logout from the subscription it is routed through, and Anthropic does not support non-Claude models behind any gateway. Codex would need a custom Responses provider in place of its one account. For my daily work, neither justifies leaving the subscription route.
• Moving targets in gated lanes. No ~latest aliases, no openrouter/auto and no mutable presets where a model must pass gates before it serves.
• Free and stealth models for anything real.

How it would stay current

OpenRouter's catalog moves fast: 57 new entries in the 30 days to 19 October, 19 entries with an expiry date (both Laguna 2.1 models I track locally were due to expire on 31 October), and ~ aliases that move silently to the newest model of a family.

My local lane already solves most of this, and the design carries over. Stable names that OpenCode uses (cloud/coder beside local/coder). Under them, a pinned model ID and a pinned host list, never an alias. Nightly candidates from family rules over the catalog. The same staged evaluation, run through OpenRouter under zero data retention against the incumbent. Promotion only when every gate passes and the score ties or beats the incumbent, with the previous choice kept for rollback and an expiry date treated as a reason to re-select early.

Two local guarantees do not carry over. Nobody hash-verifies a hosted model's weights, and pinning an endpoint does not freeze the serving stack behind it, so repeated behavioral checks replace the one-time file check. The memory-fit gate disappears; context, capacity and budget checks take its place.

The guardrails I would require

• Account-wide privacy first: hosts that train off for paid and free models, both content-logging switches off, zero data retention enforced for every model group.
• One key per use, each with a monthly limit (per-key limits exist on every plan), auto top-up off, the keys in the macOS Keychain, never in a dotfile.
• A host allow-list and a pinned, disclosed precision that my acceptance suites have tested, the lab's own endpoint first where it qualifies, require_parameters on, max_price set.
• The guard extended per launcher: local launchers stay loopback-only; a cloud launcher may reach exactly one host.
• Every request recorded with its generation ID and serving host, so a bad answer can be traced to an endpoint.
• A spend check in the status line, from /api/v1/key, next to the subscription windows it already shows.

My recommendation

OpenRouter is good at what it claims: one API, pass-through pricing, real failover, and a catalog no single lab can match. For my daily frontier work it does not replace the subscriptions, and it is never a home for work that must stay on the machine. For a three-agent harness, the right shape is narrow and staged.

The trial answers the questions the documentation cannot: whether the big open models clear my gates on my tasks, how often the reviewer fallback fires, what it costs, and whether a third lab catches what the fallback misses. At the historical fallback rate the reviewer alone could use $40 to $65 of the cap. If the budget runs out first, the result is "inconclusive", not a reason to lower an effort setting or a gate.

What would change my mind: Stripe changing the fees, the terms or the routing neutrality after the deal closes; a pattern of outages; or a local model that closes the gap on its own.

How this was researched

Sources: OpenRouter's documentation, OpenAPI spec, pricing page, terms, privacy policy, data processing agreement and blog; investor posts and press coverage; the docs and issue trackers of Claude Code, Codex and OpenCode; the alternatives' own pricing and privacy pages; Artificial Analysis, Vals, Moonshot's vendor verifier and the LessWrong post cited above; my harness's own documentation and earlier articles; and OpenRouter's public catalog, endpoint, zero-data-retention and rankings data, read on 19 October 2026. Prices, counts and rankings are snapshots from that day and will have moved by the time you read this. Paywalled reports (NYT, WSJ, Bloomberg) appear only as other outlets relayed them. No OpenRouter account or key was created for this article.