feat(secret-rotation): add OpenRouter API key rotation support by IgorHorta · Pull Request #5299 · Infisical/infisical

IgorHorta · 2026-01-28T17:33:55Z

Context

This PR implements OpenRouter API Key secret rotation support for Infisical. It includes:

Phase 1 - App Connection:

New OpenRouter App Connection that allows users to store their OpenRouter Provisioning API key
Connection validation by testing the API key against OpenRouter's API
Full frontend UI for creating and managing OpenRouter connections

Phase 2 - Secret Rotation:

New OpenRouter API Key rotation that automatically creates and rotates API keys
Dual-credential rotation strategy for zero-downtime key rotation
Configurable parameters:
- Key Name (required): Name for the generated API key
- Credit Limit (optional): Maximum credit limit for the key (leave blank for unlimited)
- Limit Reset (optional): Reset period for the limit (daily, weekly, monthly)

The rotation follows the existing Secret Rotation V2 architecture:

issueCredentials: Creates initial API key via OpenRouter Provisioning API
rotateCredentials: Creates new key, updates secrets, then deletes the old inactive key
revokeCredentials: Deletes all generated keys when rotation is removed

Related: SECRETS-71

Screenshots

Click to expand screenshots

Steps to verify the change

App Connection Tests

Navigate to Organization Settings > App Connections
Click "Add Connection" and select "OpenRouter"
Enter a valid OpenRouter Provisioning API key
Verify connection is created successfully
Verify connection validation fails with an invalid API key
Verify connection can be edited and deleted

Secret Rotation Tests

Edge Cases

Verify rotation handles OpenRouter API errors gracefully
Verify rotation works with scheduled intervals (5min, 1hr, etc.)
Verify "View Generated Credentials" modal displays correctly
Verify rotation review step shows all configured parameters

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

Add OpenRouter as a new App Connection type to enable integration with OpenRouter's Provisioning API for managing API keys. Backend: - Add OpenRouter connection enums, schemas, types, and functions - Register OpenRouter connection router and validation - Add API docs for OpenRouter credentials Frontend: - Add OpenRouter to AppConnection enum and types - Create OpenRouterConnectionForm component - Add OpenRouter to APP_CONNECTION_MAP with logo - Register form in AppConnectionForm switch statements

maidul98 · 2026-01-28T17:37:02Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-01-28T18:38:26Z

Greptile Overview

Greptile Summary

This PR adds OpenRouter API key rotation support following the existing Secret Rotation V2 architecture. The implementation includes:

App Connection (Phase 1):

New OpenRouter app connection type with API key authentication method
Connection validation by testing against OpenRouter's /keys endpoint
Frontend form with SecretInput component for secure credential entry

Secret Rotation (Phase 2):

Dual-credential rotation strategy for zero-downtime key rotation
Configurable parameters: key name (required), credit limit (optional), and limit reset period (optional)
Standard rotation lifecycle: issueCredentials, rotateCredentials, revokeCredentials
Proper error handling with OpenRouter-specific error message extraction

Key Changes:

Backend integration into rotation factory maps and service layer
Frontend forms and schemas for both connection and rotation configuration
API documentation constants for new endpoints

Issues Found:

Connection validation could be more robust by inspecting response body content
No user-facing documentation added for the feature (per Rule 5)

Confidence Score: 4/5

This PR is safe to merge with minor improvements recommended
Implementation follows established patterns from other rotation providers. Code quality is good with proper error handling, validation, and TypeScript typing. One logic issue with connection validation identified that should be addressed.
backend/src/services/app-connection/open-router/open-router-connection-fns.ts - validation logic needs improvement

Important Files Changed

Filename	Overview
backend/src/ee/services/secret-rotation-v2/open-router-api-key/open-router-api-key-rotation-fns.ts	Implements OpenRouter API key rotation with proper error handling and dual-credential rotation strategy
backend/src/services/app-connection/open-router/open-router-connection-fns.ts	Validates OpenRouter connection by testing API key against OpenRouter API
backend/src/ee/services/secret-rotation-v2/open-router-api-key/open-router-api-key-rotation-schemas.ts	Defines Zod schemas for OpenRouter API key rotation parameters and validation
frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/OpenRouterApiKeyRotationParametersFields.tsx	Form fields for configuring OpenRouter API key rotation parameters (name, credit limit, limit reset)

greptile-apps

_{4 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

...d/src/ee/services/secret-rotation-v2/open-router-api-key/open-router-api-key-rotation-fns.ts

backend/src/services/app-connection/open-router/open-router-connection-fns.ts

…penrouter-api-keys

gitguardian · 2026-01-28T19:42:15Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
22340054	Triggered	Generic Password	`cc18668`	frontend/src/pages/cert-manager/CertificateDetailsByIDPage/CertificateDetailsByIDPage.tsx	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

IgorHorta · 2026-01-28T20:03:48Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id GitGuardian status Secret Commit Filename
22340054 Triggered Generic Password cc18668 frontend/src/pages/cert-manager/CertificateDetailsByIDPage/CertificateDetailsByIDPage.tsx View secret
🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.

Replace and store your secret safely. Learn here the best practices.

Revoke and rotate this secret.

If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials

install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

I think it is saying this because it thought part of the docs was talking about secrets? 🤔

…nrouter-api-keys

...c/ee/services/secret-rotation-v2/open-router-api-key/open-router-api-key-rotation-schemas.ts

docs/documentation/platform/secret-rotation/open-router-api-key.mdx

docs/documentation/platform/secret-rotation/overview.mdx

docs/integrations/app-connections/open-router.mdx

docs/snippets/RotationsBrowser.jsx

...tend/src/components/secret-rotations-v2/forms/schemas/open-router-api-key-rotation-schema.ts

frontend/src/hooks/api/secretRotationsV2/types/open-router-api-key-rotation.ts

victorvhs017

We are missing the API Reference docs for Open Router App Connection and Secret Rotation:

victorvhs017

Missing a space in the error message.

IgorHorta · 2026-01-29T00:23:20Z

Missing a space in the error message.

this actually comes from router .. we could fix it by normalizing .. but I dont think its a good idea since they could fix it ?

Taking over review

IgorHorta added 3 commits January 27, 2026 19:44

fix: adding support for open router key rotation

d088c06

feat: adding secret rotation support for open router

9e8e156

IgorHorta changed the title ~~Igor/secrets 71 create secret rotation for openrouter api keys~~ feat(secret-rotation): add OpenRouter API key rotation support Jan 28, 2026

fix typescript issues

66f5f36

IgorHorta marked this pull request as ready for review January 28, 2026 18:34

greptile-apps bot reviewed Jan 28, 2026

View reviewed changes

...d/src/ee/services/secret-rotation-v2/open-router-api-key/open-router-api-key-rotation-fns.ts Show resolved Hide resolved

backend/src/services/app-connection/open-router/open-router-connection-fns.ts Show resolved Hide resolved

IgorHorta added 2 commits January 28, 2026 15:38

Merge branch 'main' into igor/secrets-71-create-secret-rotation-for-o…

cc18668

…penrouter-api-keys

fix: adding docs for open router rotation

f7c3e87

IgorHorta added 5 commits January 28, 2026 17:04

fixing issues with lint

1f971a8

Merge origin/main into igor/secrets-71-create-secret-rotation-for-ope…

098ee35

…nrouter-api-keys

fix: PR feedback

ead474f

fix: issue with checkbox

c035ed3

fix: addressing PR feedback

4323bc9

victorvhs017 requested changes Jan 28, 2026

View reviewed changes

victorvhs017 previously requested changes Jan 28, 2026

View reviewed changes

fix: adress PR comment

57410f4

fix: addressing PR feedback adding improvements to open router doc

74aaa2b

IgorHorta requested a review from victorvhs017 January 29, 2026 01:19

maidul98 approved these changes Jan 29, 2026

View reviewed changes

IgorHorta merged commit 3fa5771 into main Jan 29, 2026
12 of 13 checks passed

Conversation

IgorHorta commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

App Connection Tests

Secret Rotation Tests

Edge Cases

Type

Checklist

Uh oh!

maidul98 commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Jan 28, 2026

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

gitguardian bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

IgorHorta commented Jan 28, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

victorvhs017 left a comment

Choose a reason for hiding this comment

Uh oh!

victorvhs017 left a comment

Choose a reason for hiding this comment

Uh oh!

IgorHorta commented Jan 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

IgorHorta commented Jan 28, 2026 •

edited

Loading

maidul98 commented Jan 28, 2026 •

edited

Loading

gitguardian bot commented Jan 28, 2026 •

edited

Loading