Operate
OpenRouter commercial authorization
Keep production downstream resale disabled until the required authorization exists.
Server-side gate
OpenRouter integration is valid for development, internal testing, and separately authorized use. Production paid downstream traffic through OpenRouter requires explicit commercial and legal approval before the resale feature flag is enabled.
OPENROUTER_ENABLED=true
OPENROUTER_PRODUCTION_RESALE_ENABLED=false
OPENROUTER_DATA_COLLECTION=denyDo not treat a technical integration, account signup, or available API key as commercial authorization. Record the governing approval outside the application and audit the flag change.
Fail-closed behavior
- Environment flags are hard upper bounds; global_inference, openrouter_enabled, and the production resale database flag form the audited second layer.
- Every sr_live_* key uses production routing and commercial gates, even if the API process has a non-production NODE_ENV. Test keys still use real upstream inference and prepaid credits.
- Production routing excludes OpenRouter when the resale flag is false.
- The deny data policy filters data-collecting endpoints; it does not promise zero retention.
- No frontend field can enable the gate or supply an upstream key.
- Admin changes require separate authorization and create an audit event.
- If no authorized production route remains, the request fails with a normalized unavailable error.