rotate-openrouter-key

# Rotate OpenRouter Key

Safely replace the OpenRouter API key across an entire OpenClaw installation, handling all config locations, priority chains, and verification.

## When to Use

- User says "rotate my openrouter key" or "change openrouter key"
- User reports 401 errors from OpenRouter
- User disabled an old key and needs to set a new one
- Periodic key rotation for security

## Key Priority Chain

OpenClaw reads the OpenRouter API key from three sources, highest priority first:

1. **`~/.openclaw/.env`** — environment file, overrides everything
2. **`~/.openclaw/agents/<name>/agent/models.json`** — per-agent config
3. **`~/.openclaw/openclaw.json`** — global config

If a higher-priority source has the old key, updating a lower-priority file has no effect. **You must update the key at whichever level it is actually being read from.**

## Workflow

### Step 1: Get the New Key

Ask the user for the new key. It must start with `sk-or-v1-`.

If the user doesn't have one yet, direct them to [openrouter.ai/keys](https://openrouter.ai/keys) to generate one.

### Step 2: Find All Key Locations

```bash
# Find every file containing an OpenRouter key
grep -r "sk-or-v1" ~/.openclaw/ --include="*.json" --include=".env" -l 2>/dev/null

# Also check for uncommented key in .env
grep -v '^#' ~/.openclaw/.env 2>/dev/null | grep OPENROUTER_API_KEY
```

Report what you found to the user before making changes.

### Step 3: Update All Locations and Verify

Run the helper script — it handles both `.env` and JSON files in one pass:

```bash
python3 scripts/update-openrouter-key.py --key "sk-or-v1-NEW-KEY" --verify
```

The script:
- Finds all config files (`.env` + JSON) containing an openrouter key
- Creates timestamped backups before each write
- Updates only the key value (minimal change)
- Verifies the new key against the OpenRouter API
- Reports what it changed

Preview first with `--dry-run`:
```bash
python3 scripts/update-openrouter-key.py --key "sk-or-v1-NEW-KEY" --dry-run...

# Rotate OpenRouter Key

Safely rotate the OpenRouter API key across an entire OpenClaw installation.

## The Problem

OpenClaw stores the OpenRouter API key in up to three locations with a priority chain (`.env` > agent config > global config). Missing any one during rotation causes silent auth failures that are hard to diagnose.

## What It Does

1. Scans all config files to find every location where the key is stored
2. Reports the priority chain so you know which source actually controls the key
3. Updates all locations with the new key (with timestamped backups)
4. Restarts the gateway
5. Verifies the new key works against the OpenRouter API

## Install

```bash
clawhub install rotate-openrouter-key
```

Or copy the skill directory into your OpenClaw workspace `skills/` folder.

## Usage

Ask your agent:
- "Rotate my openrouter key"
- "Change my openrouter api key"
- "I'm getting 401 errors from openrouter"

### Script (standalone)

```bash
# Find where keys are stored
python3 scripts/update-openrouter-key.py --find

# Preview changes
python3 scripts/update-openrouter-key.py --key "sk-or-v1-NEW-KEY" --dry-run

# Update all locations
python3 scripts/update-openrouter-key.py --key "sk-or-v1-NEW-KEY"

# Verify key is valid
python3 scripts/update-openrouter-key.py --key "sk-or-v1-NEW-KEY" --verify
```

## Requirements

- OpenClaw installation (`~/.openclaw/`)
- Python 3.6+
- Internet access (for key verification)

## Key Priority Chain

| Priority | Source | Path |
|----------|--------|------|
| 1 (highest) | Environment / .env | `~/.openclaw/.env` |
| 2 | Agent config | `~/.openclaw/agents/<name>/agent/models.json` |
| 3 (lowest) | Global config | `~/.openclaw/openclaw.json` |

The highest-priority source wins. The skill updates all locations to prevent silent override issues.

## Reference

See `references/key-rotation-guide.md` for the complete guide covering corner cases, remote hosts, and troubleshooting.

## Future Work

- Support rotating keys for other prov...