coderouter: OpenAI and OpenRouter API keys as Responses providers

web/app/[locale]/dashboard/components/coderouter-accounts.tsx

@@ -44,11 +44,14 @@ type FormStatus = {
 const idleStatus: FormStatus = { state: "idle" };
 
 /** Everything the add panel offers, in display order. */
-type AddKind = ClaudeUpstreamKind | "codex" | "opencode";
+type ApiKeyAddKind = "openai-apikey" | "openrouter-apikey";
+type AddKind = ClaudeUpstreamKind | ApiKeyAddKind | "codex" | "opencode";
 const ADD_KINDS: readonly AddKind[] = [
   "anthropic_api_key",
   "anthropic_oauth",
   "bedrock",
+  "openai-apikey",
+  "openrouter-apikey",
   "codex",
   "opencode",
 ];
@@ -82,6 +85,8 @@ export function CoderouterAccountsSection({
   const nativeAccounts = native.kind === "ok" ? native.accounts : [];
   const sharedAccounts = shared.kind === "ok" ? shared.accounts : [];
   const total = claudeAccounts.length + nativeAccounts.length + sharedAccounts.length;
+  // Field ids are per form, so switching the add tab never leaves two inputs
+  // with one id.
   const partialFailure = claude.kind === "error" || native.kind === "error" || shared.kind === "error";
 
   return (
@@ -569,6 +574,8 @@ function AddAccountPanel({ teamId }: { readonly teamId: string }) {
               command="npx coderouter@latest add opencode"
               t={t}
             />
+          ) : kind === "openai-apikey" || kind === "openrouter-apikey" ? (
+            <ApiKeyForm key={kind} teamId={teamId} kind={kind} />
           ) : (
             <ClaudeUpstreamForm key={kind} teamId={teamId} kind={kind} />
           )}
@@ -598,6 +605,86 @@ function CliInstructions({
   );
 }
 
+/**
+ * Stores an OpenAI or OpenRouter key as a coderouter account. Codex on this
+ * team's machines then routes Responses calls through it, next to any Codex
+ * sign-ins, and moves off it on a rate limit or a rejected key.
+ */
+function ApiKeyForm({
+  teamId,
+  kind,
+}: {
+  readonly teamId: string;
+  readonly kind: ApiKeyAddKind;
+}) {
+  const t = useTranslations("dashboard.coderouterAccounts");
+  const router = useRouter();
+  const [status, setStatus] = useState<FormStatus>(idleStatus);
+
+  const submit = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    if (status.state === "submitting") return;
+    const form = event.currentTarget;
+    const data = new FormData(form);
+    const label = String(data.get("label") ?? "").trim();
+    setStatus({ state: "submitting" });
+    try {
+      const response = await fetch("/api/coderouter/accounts", {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-cmux-team-id": teamId },
+        body: JSON.stringify({
+          provider: kind,
+          apiKey: String(data.get("apiKey") ?? "").trim(),
+          ...(label ? { label } : {}),
+        }),
+      });
+      if (!response.ok) {
+        setStatus({
+          state: "error",
+          message: errorMessageForStatus(response.status, t, t("saveError")),
+        });
+        return;
+      }
+      form.reset();
+      setStatus({ state: "success", message: t("saveSuccess") });
+      router.refresh();
+    } catch {
+      setStatus({ state: "error", message: t("saveError") });
+    }
+  };
+
+  return (
+    <form onSubmit={submit} className="space-y-3">
+      <p className="text-xs text-muted">
+        {kind === "openai-apikey" ? t("openAiKeyHint") : t("openRouterKeyHint")}
+      </p>
+      <Field
+        label={t("apiKeyField")}
+        name="apiKey"
+        placeholder={kind === "openai-apikey" ? "sk-proj-..." : "sk-or-v1-..."}
+      />
+      <Field
+        label={t("labelField")}
+        name="label"
+        placeholder={t("labelPlaceholder")}
+        required={false}
+        secret={false}
+        mono={false}
+      />
+      <div className="flex flex-wrap items-center gap-3">
+        <button type="submit" disabled={status.state === "submitting"} className={primaryButtonClass}>
+          {status.state === "submitting" ? t("savingAction") : t("saveAction")}
+        </button>
+        {status.message ? (
+          <span className={`text-xs ${status.state === "error" ? "text-foreground" : "text-muted"}`}>
+            {status.message}
+          </span>
+        ) : null}
+      </div>
+    </form>
+  );
+}
+
 function ClaudeUpstreamForm({
   teamId,
   kind,
@@ -759,6 +846,10 @@ function addKindLabel(kind: AddKind, t: Translator): string {
       return t("kindCodex");
     case "opencode":
       return t("kindOpencode");
+    case "openai-apikey":
+      return t("kindOpenAiApiKey");
+    case "openrouter-apikey":
+      return t("kindOpenRouterApiKey");
     default:
       return claudeKindLabel(kind, t);
   }
@@ -771,6 +862,10 @@ function nativeKindLabel(kind: CodeRouterAccountSummary["provider"], t: Translat
       return t("kindCodex");
     case "opencode-go":
       return t("kindOpencodeGo");
+    case "openai-apikey":
+      return t("kindOpenAiApiKey");
+    case "openrouter-apikey":
+      return t("kindOpenRouterApiKey");
   }
 }
 

web/db/migrations/20260907150000_coderouter_api_key_providers/migration.sql

@@ -0,0 +1,20 @@
+-- coderouter routes the OpenAI Responses surface through pasted OpenAI and
+-- OpenRouter API keys as well as Codex sign-ins. The provider check on every
+-- coderouter table widens to admit the two key-based providers.
+ALTER TABLE "coderouter_accounts"
+  DROP CONSTRAINT IF EXISTS "coderouter_accounts_provider_check";
+ALTER TABLE "coderouter_accounts"
+  ADD CONSTRAINT "coderouter_accounts_provider_check"
+  CHECK ("provider" IN ('codex', 'opencode-go', 'openai-apikey', 'openrouter-apikey'));
+
+ALTER TABLE "coderouter_credentials"
+  DROP CONSTRAINT IF EXISTS "coderouter_credentials_provider_check";
+ALTER TABLE "coderouter_credentials"
+  ADD CONSTRAINT "coderouter_credentials_provider_check"
+  CHECK ("provider" IN ('codex', 'opencode-go', 'openai-apikey', 'openrouter-apikey'));
+
+ALTER TABLE "coderouter_session_accounts"
+  DROP CONSTRAINT IF EXISTS "coderouter_session_accounts_provider_check";
+ALTER TABLE "coderouter_session_accounts"
+  ADD CONSTRAINT "coderouter_session_accounts_provider_check"
+  CHECK ("provider" IN ('codex', 'opencode-go', 'openai-apikey', 'openrouter-apikey'));

web/db/schema.ts

@@ -1085,12 +1085,14 @@ export const subrouterTenants = pgTable(
  * live in the envelope-encrypted coderouterCredentials table; this table
  * coordinates selection and rotating refresh-token leases.
  */
+type CodeRouterProviderColumn = "codex" | "opencode-go" | "openai-apikey" | "openrouter-apikey";
+
 export const coderouterAccounts = pgTable(
   "coderouter_accounts",
   {
     id: uuid("id").defaultRandom().primaryKey(),
     teamId: text("team_id").notNull(),
-    provider: text("provider").$type<"codex" | "opencode-go">().notNull(),
+    provider: text("provider").$type<CodeRouterProviderColumn>().notNull(),
     providerAccountId: text("provider_account_id").notNull(),
     label: text("label").notNull(),
     state: text("state")
@@ -1166,7 +1168,7 @@ export const coderouterCredentials = pgTable(
       .primaryKey()
       .references(() => coderouterAccounts.id, { onDelete: "cascade" }),
     teamId: text("team_id").notNull(),
-    provider: text("provider").$type<"codex" | "opencode-go">().notNull(),
+    provider: text("provider").$type<CodeRouterProviderColumn>().notNull(),
     credentialRevision: bigint("credential_revision", { mode: "number" })
       .notNull(),
     algorithm: text("algorithm").notNull().default("aes-256-gcm"),
@@ -1219,7 +1221,7 @@ export const coderouterSessionAccounts = pgTable(
   "coderouter_session_accounts",
   {
     teamId: text("team_id").notNull(),
-    provider: text("provider").$type<"codex" | "opencode-go">().notNull(),
+    provider: text("provider").$type<CodeRouterProviderColumn>().notNull(),
     sessionKey: text("session_key").notNull(),
     accountId: uuid("account_id")
       .notNull()

web/messages/en.json

@@ -260,6 +260,7 @@
       "kindOpencode": "OpenCode",
       "kindOpencodeGo": "OpenCode Go",
       "kindOpenAiApiKey": "OpenAI API key",
+      "kindOpenRouterApiKey": "OpenRouter API key",
       "kindUnknown": "Unknown provider",
       "stateActive": "Active",
       "stateDisabled": "Disabled",
@@ -280,6 +281,8 @@
       "apiKeyField": "API key",
       "oauthTokenField": "OAuth token",
       "oauthHint": "Create a long-lived token on your own machine with",
+      "openAiKeyHint": "Codex on this team's machines sends Responses API calls to api.openai.com with this key, alongside any Codex sign-ins. Billing goes to the OpenAI project that owns the key.",
+      "openRouterKeyHint": "Codex on this team's machines sends Responses API calls to OpenRouter with this key. Bare OpenAI model ids are sent as openai/<model>.",
       "regionField": "AWS region",
       "accessKeyIdField": "Access key ID",
       "secretAccessKeyField": "Secret access key",

web/messages/ja.json

@@ -260,6 +260,7 @@
       "kindOpencode": "OpenCode",
       "kindOpencodeGo": "OpenCode Go",
       "kindOpenAiApiKey": "OpenAI APIキー",
+      "kindOpenRouterApiKey": "OpenRouter APIキー",
       "kindUnknown": "不明なプロバイダー",
       "stateActive": "有効",
       "stateDisabled": "無効",
@@ -280,6 +281,8 @@
       "apiKeyField": "APIキー",
       "oauthTokenField": "OAuthトークン",
       "oauthHint": "自分のマシンで次のコマンドを実行して長期トークンを作成します:",
+      "openAiKeyHint": "このチームのマシン上の Codex は、Codex サインインと並んでこのキーで api.openai.com に Responses API を送信します。請求はキーを所有する OpenAI プロジェクトに行われます。",
+      "openRouterKeyHint": "このチームのマシン上の Codex は、このキーで OpenRouter に Responses API を送信します。ベンダー接頭辞のない OpenAI モデル ID は openai/<model> として送られます。",
       "regionField": "AWSリージョン",
       "accessKeyIdField": "アクセスキーID",
       "secretAccessKeyField": "シークレットアクセスキー",

web/services/coderouter/accounts.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import {
   findAccountByProviderIdentity,
   deleteAccount,
@@ -8,7 +8,11 @@ import {
   withVaultLease,
 } from "./repository";
 import { encryptCredential } from "./encryption";
-import type { CodeRouterCredential } from "./types";
+import {
+  CODEROUTER_API_KEY_PROVIDERS,
+  type CodeRouterApiKeyProvider,
+  type CodeRouterCredential,
+} from "./types";
 import { deleteVaultCredential } from "./vault";
 import { reportCoderouterFailure } from "./observability";
 
@@ -97,9 +101,14 @@ export const removeAccount = createAccountRemover({
   report: reportCoderouterFailure,
 });
 
+const MAX_API_KEY_LENGTH = 512;
+const MAX_LABEL_LENGTH = 120;
+const API_KEY_PATTERN = /^[A-Za-z0-9._~+/=-]+$/;
+
 export function parseCredential(value: unknown): CodeRouterCredential | null {
   if (!isRecord(value)) return null;
   const provider = value.provider;
+  if (isApiKeyProviderName(provider)) return parseApiKeyCredential(provider, value);
   const accessToken = boundedString(value.accessToken, 32_768);
   const refreshToken = boundedString(value.refreshToken, 32_768);
   const accountId = boundedString(value.accountId, 512);
@@ -147,6 +156,40 @@ export function parseCredential(value: unknown): CodeRouterCredential | null {
   return null;
 }
 
+function isApiKeyProviderName(value: unknown): value is CodeRouterApiKeyProvider {
+  return typeof value === "string" &&
+    (CODEROUTER_API_KEY_PROVIDERS as readonly string[]).includes(value);
+}
+
+/**
+ * `{ provider, apiKey, label? }` from the dashboard or `cr add`. The key is
+ * validated as one printable token; the fingerprint becomes the provider
+ * account id, so re-adding the same key updates the existing row.
+ */
+function parseApiKeyCredential(
+  provider: CodeRouterApiKeyProvider,
+  value: Record<string, unknown>,
+): CodeRouterCredential | null {
+  const apiKey = typeof value.apiKey === "string" ? value.apiKey.trim() : "";
+  if (apiKey.length < 16 || apiKey.length > MAX_API_KEY_LENGTH || !API_KEY_PATTERN.test(apiKey)) {
+    return null;
+  }
+  const rawLabel = value.label;
+  if (rawLabel !== undefined && rawLabel !== null && typeof rawLabel !== "string") return null;
+  const label = typeof rawLabel === "string" ? rawLabel.trim() : "";
+  if (label.length > MAX_LABEL_LENGTH) return null;
+  return {
+    provider,
+    apiKey,
+    accountId: apiKeyFingerprint(provider, apiKey),
+    label,
+  };
+}
+
+export function apiKeyFingerprint(provider: CodeRouterApiKeyProvider, apiKey: string): string {
+  return createHash("sha256").update(`${provider}\n${apiKey}`).digest("hex").slice(0, 24);
+}
+
 function boundedString(value: unknown, max: number): string | null {
   return typeof value === "string" && value.length > 0 && value.length <= max
     ? value

web/services/coderouter/analytics.ts

@@ -418,6 +418,7 @@ function accountProvider(value: unknown): string | null {
     "openai-apikey",
     "anthropic-apikey",
     "opencode-go",
+    "openrouter-apikey",
   ]);
 }