# openrouter-secrets

A chat endpoint that forwards to a model on OpenRouter, built on
[hello-world](../hello-world). It shows how a capsule asks for a network host
and an API key, and how m64 keeps the key out of the container.

## What it shows

- `[network] needs` and `why`: the one host the capsule may reach, and the reason
  the person reads before granting it.
- `[secrets] required`: the key it needs, by name.
- `[[secrets.inject]]`: m64's gate adds `Authorization: Bearer <key>` to requests
  for `openrouter.ai`, so `server.py` never reads the key. It calls plain
  `http://openrouter.ai` through `$HTTP_PROXY`, and the gate does TLS.

## Run it

Store the key once. The value is read from a hidden prompt and never printed:

```sh
m64 config secrets set OPENROUTER_API_KEY
m64 config secrets list                    # names only
```

Then serve it. The network has to be granted explicitly:

```sh
m64 check examples/openrouter-secrets
m64 serve examples/openrouter-secrets --allow-external-network
```

To keep a capsule's secrets in their own file instead, pass
`--secret-file path/to/file.env` (lines like `OPENROUTER_API_KEY=...`).

Without the key, the serve is refused: `missing secrets: OPENROUTER_API_KEY`.
Without `--allow-external-network`, it is refused too, naming the flag.

## What to look at

- `m64 net <id>`: the capsule's connections, all to `openrouter.ai:443`.
- `m64 check` on a copy with a real key pasted into `server.py`: the push is
  blocked before anything is uploaded.
- `/agent` explains the errors: 401 is a key problem, 502 a network problem.