openrouter-secrets

A chat endpoint that forwards to a model on OpenRouter, built on hello-world. It shows how a capsule asks for a network host and an API key, and how m64 keeps the key out of the container.

What it shows

• [network] needs and why: the one host the capsule may reach, and the reason the person reads before granting it.
• [secrets] required: the key it needs, by name.
• [[secrets.inject]]: m64's gate adds Authorization: Bearer <key> to requests for openrouter.ai, so server.py never reads the key. It calls plain http://openrouter.ai through $HTTP_PROXY, and the gate does TLS.

Run it

Store the key once. The value is read from a hidden prompt and never printed:

m64 config secrets set OPENROUTER_API_KEY
m64 config secrets list                    # names only

Then serve it. The network has to be granted explicitly:

m64 check examples/openrouter-secrets
m64 serve examples/openrouter-secrets --allow-external-network

To keep a capsule's secrets in their own file instead, pass --secret-file path/to/file.env (lines like OPENROUTER_API_KEY=...).

Without the key, the serve is refused: missing secrets: OPENROUTER_API_KEY. Without --allow-external-network, it is refused too, naming the flag.

What to look at

• m64 net <id>: the capsule's connections, all to openrouter.ai:443.
• m64 check on a copy with a real key pasted into server.py: the push is blocked before anything is uploaded.
• /agent explains the errors: 401 is a key problem, 502 a network problem.