OpenRouter restructured its Terms of Service to add detailed provisions governing API credentials, promotional credits, and credit mechanics. The updated terms now explicitly state that users are responsible for all activity under their API credentials except where caused by OpenRouter's breach, require prompt notification of credential compromise, and authorize OpenRouter to suspend or revoke credentials if reasonably necessary to protect the Service or parties involved. The terms also introduce a new section defining promotional credits as non-refundable, non-transferable, and subject to expiration, with OpenRouter retaining discretion over the order in which purchased and promotional credits are applied.
Consumers: You are liable for everything that happens under your account or API keys, unless OpenRouter itself broke its agreement with you.
Consumers: If you think your API keys have been stolen or misused, you must tell OpenRouter right away.
Consumers: OpenRouter can shut off your API access if it thinks that is needed to protect itself, you, or anyone else.
Consumers: Free promotional credits cannot be converted to cash, given to someone else, or refunded, and they expire on a date OpenRouter sets.
The updated terms establish explicit liability for all activity and charges under a user's account or API credentials, except where directly caused by OpenRouter's breach of the Terms. Users must now promptly notify OpenRouter of any actual or suspected compromise or unauthorized use of credentials. OpenRouter reserves the right to suspend, revoke, or limit API credentials or account access if it reasonably believes doing so is necessary to protect the Service, the user, OpenRouter, or any third party. Additionally, promotional credits are now defined as non-refundable, non-transferable, and subject to expiration, with no cash value and no entitlement to standard refund rights. You can review your API credential security settings and update your account information through your account page.
→ Review your API credential security practices and ensure passwords and tokens are stored securely.
→ Establish a process to promptly report any suspected compromise or unauthorized use of your API credentials to OpenRouter.
→ Track the expiration dates of any promotional credits issued to your account and plan usage accordingly.
ConductAtlas has recorded 2 material changes to this document (since July 2026).
Across all monitored documents, OpenRouter has made 3 significant changes.
Users are responsible for all activity and charges under their account or API credentials, except where directly caused by OpenRouter's breach of the Terms.
Users must promptly notify OpenRouter of any actual or suspected compromise or unauthorized use of API credentials.
Promotional credits are non-refundable, non-transferable, have no cash value, and are subject to expiration; OpenRouter may determine the order in which purchased and promotional credits are applied.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
OpenRouter has restructured its credential and credit management provisions to clarify user liability for account activity and establish formal rules for promotional credit handling. The change introduces explicit liability for unauthorized account activity (with a …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-004197.
OpenRouter's privacy policy now includes an additional disclosure circumstance for data sharing: routing API requests in-region in Europe through EU …
OpenRouter expanded its privacy policy to document a new Files API feature that allows users to upload and persistently store …
OpenRouter raised its minimum age requirement from 13 to 18 years old and removed the parental consent option for users …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.