OpenRouter

An OpenRouter connection sends the models you choose through OpenRouter with your own credential, so OpenRouter bills your account for inference instead of Amp. Enterprise pricing can still add an Amp fee.

The connection authenticates with an API key by default. On an OpenRouter Business or Enterprise plan, it can instead use workload identity federation, so Amp stores no key or secret. Both are the same kind of connection, with the same models and settings.

Set Up a Connection

Create an API key in OpenRouter. Then open personal model routing or workspace model routing, add an OpenRouter connection, paste the key, and save.

Use the Check Access button to confirm that OpenRouter accepts the key.

You can also add the connection from the CLI, with the key in OPENROUTER_API_KEY:

amp config model-providers add-router openrouter --workspace

Workload Identity Federation

With workload identity federation, Amp acts as one of your OpenRouter workspace API keys without storing it. You register Amp as an issuer in OpenRouter and add a policy that admits only tokens for your Amp workspace or user. Amp stores only the policy ID. Before it sends requests, Amp signs a short-lived token and exchanges it with OpenRouter for a short-lived access token. This requires an OpenRouter Business or Enterprise plan.

In the connection form, choose Workload Identity Federation as the authentication method. The form shows these steps with your own issuer and subject:

Sign in to see your own AMP_ISSUER and AMP_SUBJECT values.
  1. In OpenRouter, open Settings > Workload identity and add an issuer with the issuer URL AMP_ISSUER . Leave the JWKS URL empty. OpenRouter workload identity
  2. Add a policy for that issuer with the subject AMP_SUBJECT , the audience https://openrouter.ai/api/v1 , and the workspace API key Amp should act as.
  3. Enter the federation policy ID in Amp with Workload Identity Federation selected as the authentication method, then save and run Check Access.

Enter the policy ID, then save and use Check Access. For OpenRouter, Check Access runs the token exchange but does not run inference.

From the CLI, print the same steps with amp config model-providers setup-guide openrouter --workspace, then add the connection:

amp config model-providers add-router openrouter --workspace \
  --openrouter-federation-policy-id <id>

To switch an existing connection between an API key and workload identity federation, edit it and choose the other authentication method. The connection keeps its ID, its model settings, and its place in the connection order.

For more, see OpenRouter’s documentation on workload identity federation.