@openrouter/sdk 1.2.98 → 1.2.100

package/esm/funcs/apiKeysCreate.d.ts

@@ -12,7 +12,7 @@ import { Result } from "../types/fp.js";
  * Create a new API key
  *
  * @remarks
- * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret.
+ * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys). The optional `external` object associates the key with a partner-defined user and lookup key.
  */
 export declare function apiKeysCreate(client: OpenRouterCore, request: operations.CreateKeysRequest, options?: RequestOptions): APIPromise<Result<operations.CreateKeysResponse, errors.BadRequestResponseError | errors.UnauthorizedResponseError | errors.ForbiddenResponseError | errors.TooManyRequestsResponseError | errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=apiKeysCreate.d.ts.map

package/esm/funcs/apiKeysCreate.js

@@ -16,7 +16,7 @@ import { APIPromise } from "../types/async.js";
  * Create a new API key
  *
  * @remarks
- * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret.
+ * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys). The optional `external` object associates the key with a partner-defined user and lookup key.
  */
 export function apiKeysCreate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/esm/funcs/apiKeysDelete.d.ts

@@ -12,7 +12,7 @@ import { Result } from "../types/fp.js";
  * Delete an API key
  *
  * @remarks
- * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+ * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
  */
 export declare function apiKeysDelete(client: OpenRouterCore, request: operations.DeleteKeysRequest, options?: RequestOptions): APIPromise<Result<operations.DeleteKeysResponse, errors.UnauthorizedResponseError | errors.NotFoundResponseError | errors.TooManyRequestsResponseError | errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=apiKeysDelete.d.ts.map

package/esm/funcs/apiKeysDelete.js

@@ -16,7 +16,7 @@ import { APIPromise } from "../types/async.js";
  * Delete an API key
  *
  * @remarks
- * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+ * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
  */
 export function apiKeysDelete(client, request, options) {
     return new APIPromise($do(client, request, options));

package/esm/funcs/apiKeysUpdate.d.ts

@@ -12,7 +12,7 @@ import { Result } from "../types/fp.js";
  * Update an API key
  *
  * @remarks
- * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+ * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
  */
 export declare function apiKeysUpdate(client: OpenRouterCore, request: operations.UpdateKeysRequest, options?: RequestOptions): APIPromise<Result<operations.UpdateKeysResponse, errors.BadRequestResponseError | errors.UnauthorizedResponseError | errors.NotFoundResponseError | errors.TooManyRequestsResponseError | errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=apiKeysUpdate.d.ts.map

package/esm/funcs/apiKeysUpdate.js

@@ -16,7 +16,7 @@ import { APIPromise } from "../types/async.js";
  * Update an API key
  *
  * @remarks
- * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+ * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
  */
 export function apiKeysUpdate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/esm/funcs/oAuthCreateOauthToken.d.ts

@@ -0,0 +1,19 @@
+import { OpenRouterCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { OpenRouterError } from "../models/errors/openroutererror.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+/**
+ * Exchange a workload identity token
+ *
+ * @remarks
+ * RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.
+ */
+export declare function oAuthCreateOauthToken(client: OpenRouterCore, request: operations.CreateOauthTokenRequest, options?: RequestOptions): APIPromise<Result<models.TokenExchangeResponse, errors.OAuthErrorResponse | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=oAuthCreateOauthToken.d.ts.map

package/esm/funcs/oAuthCreateOauthToken.js

@@ -0,0 +1,100 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: e5f6a20bb612
+ */
+import { encodeBodyForm, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as errors from "../models/errors/index.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+/**
+ * Exchange a workload identity token
+ *
+ * @remarks
+ * RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.
+ */
+export function oAuthCreateOauthToken(client, request, options) {
+    return new APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = safeParse(request, (value) => operations.CreateOauthTokenRequest$outboundSchema.parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = Object.entries(payload.TokenExchangeRequest || {}).map(([k, v]) => {
+        return encodeBodyForm(k, v, { charEncoding: "percent" });
+    }).join("&");
+    const path = pathToFunc("/oauth/token")();
+    const headers = new Headers(compactMap({
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        "HTTP-Referer": encodeSimple("HTTP-Referer", payload["HTTP-Referer"] ?? client._options.httpReferer, { explode: false, charEncoding: "none" }),
+        "X-OpenRouter-Categories": encodeSimple("X-OpenRouter-Categories", payload.appCategories ?? client._options.appCategories, { explode: false, charEncoding: "none" }),
+        "X-OpenRouter-Title": encodeSimple("X-OpenRouter-Title", payload.appTitle ?? client._options.appTitle, { explode: false, charEncoding: "none" }),
+    }));
+    const secConfig = await extractSecurity(client._options.apiKey);
+    const securityInput = secConfig == null ? {} : { apiKey: secConfig };
+    const requestSecurity = resolveGlobalSecurity(securityInput);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "createOauthToken",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.apiKey,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || {
+                strategy: "backoff",
+                backoff: {
+                    initialInterval: 500,
+                    maxInterval: 60000,
+                    exponent: 1.5,
+                    maxElapsedTime: 3600000,
+                },
+                retryConnectionErrors: true,
+            }
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["5XX"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => matchStatusCode({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, models.TokenExchangeResponse$inboundSchema), M.jsonErr([400, 429], errors.OAuthErrorResponse$inboundSchema), M.jsonErr([500, 503], errors.OAuthErrorResponse$inboundSchema), M.fail("4XX"), M.fail("5XX"))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oAuthCreateOauthToken.js.map

package/esm/funcs/oAuthListOauthJwks.d.ts

@@ -0,0 +1,19 @@
+import { OpenRouterCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { OpenRouterError } from "../models/errors/openroutererror.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+/**
+ * OpenRouter access token signing keys
+ *
+ * @remarks
+ * RFC 7517 JWK Set containing the public keys OpenRouter signs access tokens with.
+ */
+export declare function oAuthListOauthJwks(client: OpenRouterCore, request?: operations.ListOauthJwksRequest | undefined, options?: RequestOptions): APIPromise<Result<models.OAuthJwks, errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=oAuthListOauthJwks.d.ts.map

package/esm/funcs/oAuthListOauthJwks.js

@@ -0,0 +1,97 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: f7899acb7c1e
+ */
+import { encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as errors from "../models/errors/index.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+/**
+ * OpenRouter access token signing keys
+ *
+ * @remarks
+ * RFC 7517 JWK Set containing the public keys OpenRouter signs access tokens with.
+ */
+export function oAuthListOauthJwks(client, request, options) {
+    return new APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = safeParse(request, (value) => operations.ListOauthJwksRequest$outboundSchema.optional().parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = null;
+    const path = pathToFunc("/oauth/jwks")();
+    const headers = new Headers(compactMap({
+        Accept: "application/json",
+        "HTTP-Referer": encodeSimple("HTTP-Referer", payload?.["HTTP-Referer"] ?? client._options.httpReferer, { explode: false, charEncoding: "none" }),
+        "X-OpenRouter-Categories": encodeSimple("X-OpenRouter-Categories", payload?.appCategories ?? client._options.appCategories, { explode: false, charEncoding: "none" }),
+        "X-OpenRouter-Title": encodeSimple("X-OpenRouter-Title", payload?.appTitle ?? client._options.appTitle, { explode: false, charEncoding: "none" }),
+    }));
+    const secConfig = await extractSecurity(client._options.apiKey);
+    const securityInput = secConfig == null ? {} : { apiKey: secConfig };
+    const requestSecurity = resolveGlobalSecurity(securityInput);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "listOauthJwks",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.apiKey,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || {
+                strategy: "backoff",
+                backoff: {
+                    initialInterval: 500,
+                    maxInterval: 60000,
+                    exponent: 1.5,
+                    maxElapsedTime: 3600000,
+                },
+                retryConnectionErrors: true,
+            }
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["5XX"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "GET",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => matchStatusCode({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(200, models.OAuthJwks$inboundSchema), M.jsonErr(500, errors.InternalServerResponseError$inboundSchema), M.fail("4XX"), M.fail("5XX"))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=oAuthListOauthJwks.js.map

package/esm/lib/config.d.ts

@@ -50,8 +50,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "1.0.0";
-    readonly sdkVersion: "1.2.98";
+    readonly sdkVersion: "1.2.100";
     readonly genVersion: "2.914.0";
-    readonly userAgent: "speakeasy-sdk/typescript 1.2.98 2.914.0 1.0.0 @openrouter/sdk";
+    readonly userAgent: "speakeasy-sdk/typescript 1.2.100 2.914.0 1.0.0 @openrouter/sdk";
 };
 //# sourceMappingURL=config.d.ts.map

package/esm/lib/config.js

@@ -29,8 +29,8 @@ export function serverURLFromOptions(options) {
 export const SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1.0.0",
-    sdkVersion: "1.2.98",
+    sdkVersion: "1.2.100",
     genVersion: "2.914.0",
-    userAgent: "speakeasy-sdk/typescript 1.2.98 2.914.0 1.0.0 @openrouter/sdk",
+    userAgent: "speakeasy-sdk/typescript 1.2.100 2.914.0 1.0.0 @openrouter/sdk",
 };
 //# sourceMappingURL=config.js.map

package/esm/models/errors/index.d.ts

@@ -6,6 +6,7 @@ export * from "./forbiddenresponseerror.js";
 export * from "./httpclienterrors.js";
 export * from "./internalserverresponseerror.js";
 export * from "./notfoundresponseerror.js";
+export * from "./oautherrorresponse.js";
 export * from "./openrouterdefaulterror.js";
 export * from "./openroutererror.js";
 export * from "./payloadtoolargeresponseerror.js";

package/esm/models/errors/index.js

@@ -10,6 +10,7 @@ export * from "./forbiddenresponseerror.js";
 export * from "./httpclienterrors.js";
 export * from "./internalserverresponseerror.js";
 export * from "./notfoundresponseerror.js";
+export * from "./oautherrorresponse.js";
 export * from "./openrouterdefaulterror.js";
 export * from "./openroutererror.js";
 export * from "./payloadtoolargeresponseerror.js";

package/esm/models/errors/oautherrorresponse.d.ts

@@ -0,0 +1,27 @@
+import * as z from "zod/v4";
+import * as models from "../index.js";
+import { OpenRouterError } from "./openroutererror.js";
+/**
+ * RFC 6749 §5.2 error response.
+ */
+export type OAuthErrorResponseData = {
+    error: models.ErrorEnum;
+    errorDescription: string;
+};
+/**
+ * RFC 6749 §5.2 error response.
+ */
+export declare class OAuthErrorResponse extends OpenRouterError {
+    error: models.ErrorEnum;
+    errorDescription: string;
+    /** The original data that was passed to this error instance. */
+    data$: OAuthErrorResponseData;
+    constructor(err: OAuthErrorResponseData, httpMeta: {
+        response: Response;
+        request: Request;
+        body: string;
+    });
+}
+/** @internal */
+export declare const OAuthErrorResponse$inboundSchema: z.ZodType<OAuthErrorResponse, unknown>;
+//# sourceMappingURL=oautherrorresponse.d.ts.map

package/esm/models/errors/oautherrorresponse.js

@@ -0,0 +1,42 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: b0268e4f0a4e
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../../lib/primitives.js";
+import * as models from "../index.js";
+import { OpenRouterError } from "./openroutererror.js";
+/**
+ * RFC 6749 §5.2 error response.
+ */
+export class OAuthErrorResponse extends OpenRouterError {
+    constructor(err, httpMeta) {
+        const message = "message" in err && typeof err.message === "string"
+            ? err.message
+            : `API error occurred: ${JSON.stringify(err)}`;
+        super(message, httpMeta);
+        this.data$ = err;
+        this.error = err.error;
+        this.errorDescription = err.errorDescription;
+        this.name = "OAuthErrorResponse";
+    }
+}
+/** @internal */
+export const OAuthErrorResponse$inboundSchema = z.object({
+    error: models.ErrorEnum$inboundSchema,
+    error_description: z.string(),
+    request$: z.custom(x => x instanceof Request),
+    response$: z.custom(x => x instanceof Response),
+    body$: z.string(),
+})
+    .transform((v) => {
+    const remapped = remap$(v, {
+        "error_description": "errorDescription",
+    });
+    return new OAuthErrorResponse(remapped, {
+        request: v.request$,
+        response: v.response$,
+        body: v.body$,
+    });
+});
+//# sourceMappingURL=oautherrorresponse.js.map

package/esm/models/index.d.ts

@@ -350,6 +350,8 @@ export * from "./multimodalmedia.js";
 export * from "./namespacefunctiontool.js";
 export * from "./namespacetool.js";
 export * from "./notfoundresponseerrordata.js";
+export * from "./oautherrorresponse.js";
+export * from "./oauthjwks.js";
 export * from "./observabilityarizedestination.js";
 export * from "./observabilitybraintrustdestination.js";
 export * from "./observabilityclickhousedestination.js";
@@ -561,6 +563,8 @@ export * from "./taskclassificationresponse.js";
 export * from "./textdeltaevent.js";
 export * from "./textdoneevent.js";
 export * from "./textextendedconfig.js";
+export * from "./tokenexchangerequest.js";
+export * from "./tokenexchangeresponse.js";
 export * from "./toolcallstatus.js";
 export * from "./toolchoiceallowed.js";
 export * from "./toolchoicesupport.js";

package/esm/models/index.js

@@ -354,6 +354,8 @@ export * from "./multimodalmedia.js";
 export * from "./namespacefunctiontool.js";
 export * from "./namespacetool.js";
 export * from "./notfoundresponseerrordata.js";
+export * from "./oautherrorresponse.js";
+export * from "./oauthjwks.js";
 export * from "./observabilityarizedestination.js";
 export * from "./observabilitybraintrustdestination.js";
 export * from "./observabilityclickhousedestination.js";
@@ -565,6 +567,8 @@ export * from "./taskclassificationresponse.js";
 export * from "./textdeltaevent.js";
 export * from "./textdoneevent.js";
 export * from "./textextendedconfig.js";
+export * from "./tokenexchangerequest.js";
+export * from "./tokenexchangeresponse.js";
 export * from "./toolcallstatus.js";
 export * from "./toolchoiceallowed.js";
 export * from "./toolchoicesupport.js";

package/esm/models/oautherrorresponse.d.ts

@@ -0,0 +1,14 @@
+import * as z from "zod/v4";
+import { OpenEnum } from "../types/enums.js";
+export declare const ErrorEnum: {
+    readonly InvalidRequest: "invalid_request";
+    readonly InvalidGrant: "invalid_grant";
+    readonly UnsupportedGrantType: "unsupported_grant_type";
+    readonly InvalidScope: "invalid_scope";
+    readonly ServerError: "server_error";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+};
+export type ErrorEnum = OpenEnum<typeof ErrorEnum>;
+/** @internal */
+export declare const ErrorEnum$inboundSchema: z.ZodType<ErrorEnum, unknown>;
+//# sourceMappingURL=oautherrorresponse.d.ts.map

package/esm/models/oautherrorresponse.js

@@ -0,0 +1,17 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 2e54250dbb09
+ */
+import * as openEnums from "../types/enums.js";
+export const ErrorEnum = {
+    InvalidRequest: "invalid_request",
+    InvalidGrant: "invalid_grant",
+    UnsupportedGrantType: "unsupported_grant_type",
+    InvalidScope: "invalid_scope",
+    ServerError: "server_error",
+    TemporarilyUnavailable: "temporarily_unavailable",
+};
+/** @internal */
+export const ErrorEnum$inboundSchema = openEnums
+    .inboundSchema(ErrorEnum);
+//# sourceMappingURL=oautherrorresponse.js.map

package/esm/models/oauthjwks.d.ts

@@ -0,0 +1,50 @@
+import * as z from "zod/v4";
+import { ClosedEnum } from "../types/enums.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+export declare const Alg: {
+    readonly Es256: "ES256";
+};
+export type Alg = ClosedEnum<typeof Alg>;
+export declare const Crv: {
+    readonly P256: "P-256";
+};
+export type Crv = ClosedEnum<typeof Crv>;
+export declare const Kty: {
+    readonly Ec: "EC";
+};
+export type Kty = ClosedEnum<typeof Kty>;
+export declare const Use: {
+    readonly Sig: "sig";
+};
+export type Use = ClosedEnum<typeof Use>;
+export type Key = {
+    alg: Alg;
+    crv: Crv;
+    kid: string;
+    kty: Kty;
+    use: Use;
+    x: string;
+    y: string;
+};
+/**
+ * RFC 7517 JWK Set of the keys OpenRouter signs access tokens with.
+ */
+export type OAuthJwks = {
+    keys: Array<Key>;
+};
+/** @internal */
+export declare const Alg$inboundSchema: z.ZodEnum<typeof Alg>;
+/** @internal */
+export declare const Crv$inboundSchema: z.ZodEnum<typeof Crv>;
+/** @internal */
+export declare const Kty$inboundSchema: z.ZodEnum<typeof Kty>;
+/** @internal */
+export declare const Use$inboundSchema: z.ZodEnum<typeof Use>;
+/** @internal */
+export declare const Key$inboundSchema: z.ZodType<Key, unknown>;
+export declare function keyFromJSON(jsonString: string): SafeParseResult<Key, SDKValidationError>;
+/** @internal */
+export declare const OAuthJwks$inboundSchema: z.ZodType<OAuthJwks, unknown>;
+export declare function oAuthJwksFromJSON(jsonString: string): SafeParseResult<OAuthJwks, SDKValidationError>;
+//# sourceMappingURL=oauthjwks.d.ts.map

package/esm/models/oauthjwks.js

@@ -0,0 +1,47 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: fa2c53553900
+ */
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+export const Alg = {
+    Es256: "ES256",
+};
+export const Crv = {
+    P256: "P-256",
+};
+export const Kty = {
+    Ec: "EC",
+};
+export const Use = {
+    Sig: "sig",
+};
+/** @internal */
+export const Alg$inboundSchema = z.enum(Alg);
+/** @internal */
+export const Crv$inboundSchema = z.enum(Crv);
+/** @internal */
+export const Kty$inboundSchema = z.enum(Kty);
+/** @internal */
+export const Use$inboundSchema = z.enum(Use);
+/** @internal */
+export const Key$inboundSchema = z.object({
+    alg: Alg$inboundSchema,
+    crv: Crv$inboundSchema,
+    kid: z.string(),
+    kty: Kty$inboundSchema,
+    use: Use$inboundSchema,
+    x: z.string(),
+    y: z.string(),
+});
+export function keyFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => Key$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'Key' from JSON`);
+}
+/** @internal */
+export const OAuthJwks$inboundSchema = z.object({
+    keys: z.array(z.lazy(() => Key$inboundSchema)),
+});
+export function oAuthJwksFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => OAuthJwks$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'OAuthJwks' from JSON`);
+}
+//# sourceMappingURL=oauthjwks.js.map

package/esm/models/operations/createkeys.d.ts

@@ -23,6 +23,19 @@ export type CreateKeysGlobals = {
      */
     appCategories?: string | undefined;
 };
+/**
+ * Optional partner-defined identity associated with the created API key.
+ */
+export type External = {
+    /**
+     * Optional partner-supplied API key with a minimum length of 32 characters and sufficient entropy. Stored as a SHA-256 hash and never returned.
+     */
+    apiKey?: string | undefined;
+    /**
+     * Partner's end-user identifier for attribution.
+     */
+    user: string;
+};
 /**
  * Type of limit reset for the API key (daily, weekly, monthly, or null for no reset). Resets happen automatically at midnight UTC, and weeks are Monday through Sunday.
  */
@@ -44,6 +57,10 @@ export type CreateKeysRequestBody = {
      * Optional ISO 8601 UTC expiration timestamp. Must include seconds (YYYY-MM-DDTHH:MM:SSZ; fractional seconds allowed); minute-precision timestamps are rejected.
      */
     expiresAt?: Date | null | undefined;
+    /**
+     * Optional partner-defined identity associated with the created API key.
+     */
+    external?: External | undefined;
     /**
      * Whether to include BYOK usage in the limit
      */
@@ -194,11 +211,20 @@ export type CreateKeysResponse = {
     key: string;
 };
 /** @internal */
+export type External$Outbound = {
+    api_key?: string | undefined;
+    user: string;
+};
+/** @internal */
+export declare const External$outboundSchema: z.ZodType<External$Outbound, External>;
+export declare function externalToJSON(external: External): string;
+/** @internal */
 export declare const CreateKeysLimitReset$outboundSchema: z.ZodType<string, CreateKeysLimitReset>;
 /** @internal */
 export type CreateKeysRequestBody$Outbound = {
     creator_user_id?: string | null | undefined;
     expires_at?: string | null | undefined;
+    external?: External$Outbound | undefined;
     include_byok_in_limit?: boolean | undefined;
     limit?: number | null | undefined;
     limit_reset?: string | null | undefined;

package/esm/models/operations/createkeys.js

@@ -15,11 +15,25 @@ export const CreateKeysLimitReset = {
     Monthly: "monthly",
 };
 /** @internal */
+export const External$outboundSchema = z
+    .object({
+    apiKey: z.string().optional(),
+    user: z.string(),
+}).transform((v) => {
+    return remap$(v, {
+        apiKey: "api_key",
+    });
+});
+export function externalToJSON(external) {
+    return JSON.stringify(External$outboundSchema.parse(external));
+}
+/** @internal */
 export const CreateKeysLimitReset$outboundSchema = openEnums.outboundSchema(CreateKeysLimitReset);
 /** @internal */
 export const CreateKeysRequestBody$outboundSchema = z.object({
     creatorUserId: z.nullable(z.string()).optional(),
     expiresAt: z.nullable(z.date().transform(v => v.toISOString())).optional(),
+    external: z.lazy(() => External$outboundSchema).optional(),
     includeByokInLimit: z.boolean().optional(),
     limit: z.nullable(z.number()).optional(),
     limitReset: z.nullable(CreateKeysLimitReset$outboundSchema).optional(),

package/esm/models/operations/createoauthtoken.d.ts

@@ -0,0 +1,56 @@
+import * as z from "zod/v4";
+import * as models from "../index.js";
+export type CreateOauthTokenGlobals = {
+    /**
+     * The app identifier should be your app's URL and is used as the primary identifier for rankings.
+     *
+     * @remarks
+     * This is used to track API usage per application.
+     */
+    httpReferer?: string | undefined;
+    /**
+     * The app display name allows you to customize how your app appears in OpenRouter's dashboard.
+     *
+     * @remarks
+     */
+    appTitle?: string | undefined;
+    /**
+     * Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings.
+     *
+     * @remarks
+     */
+    appCategories?: string | undefined;
+};
+export type CreateOauthTokenRequest = {
+    /**
+     * The app identifier should be your app's URL and is used as the primary identifier for rankings.
+     *
+     * @remarks
+     * This is used to track API usage per application.
+     */
+    httpReferer?: string | undefined;
+    /**
+     * The app display name allows you to customize how your app appears in OpenRouter's dashboard.
+     *
+     * @remarks
+     */
+    appTitle?: string | undefined;
+    /**
+     * Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings.
+     *
+     * @remarks
+     */
+    appCategories?: string | undefined;
+    tokenExchangeRequest: models.TokenExchangeRequest;
+};
+/** @internal */
+export type CreateOauthTokenRequest$Outbound = {
+    "HTTP-Referer"?: string | undefined;
+    appTitle?: string | undefined;
+    appCategories?: string | undefined;
+    TokenExchangeRequest: models.TokenExchangeRequest$Outbound;
+};
+/** @internal */
+export declare const CreateOauthTokenRequest$outboundSchema: z.ZodType<CreateOauthTokenRequest$Outbound, CreateOauthTokenRequest>;
+export declare function createOauthTokenRequestToJSON(createOauthTokenRequest: CreateOauthTokenRequest): string;
+//# sourceMappingURL=createoauthtoken.d.ts.map

package/esm/models/operations/createoauthtoken.js

@@ -0,0 +1,23 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 12bca86790cc
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../../lib/primitives.js";
+import * as models from "../index.js";
+/** @internal */
+export const CreateOauthTokenRequest$outboundSchema = z.object({
+    httpReferer: z.string().optional(),
+    appTitle: z.string().optional(),
+    appCategories: z.string().optional(),
+    tokenExchangeRequest: models.TokenExchangeRequest$outboundSchema,
+}).transform((v) => {
+    return remap$(v, {
+        httpReferer: "HTTP-Referer",
+        tokenExchangeRequest: "TokenExchangeRequest",
+    });
+});
+export function createOauthTokenRequestToJSON(createOauthTokenRequest) {
+    return JSON.stringify(CreateOauthTokenRequest$outboundSchema.parse(createOauthTokenRequest));
+}
+//# sourceMappingURL=createoauthtoken.js.map

package/esm/models/operations/index.d.ts

@@ -13,6 +13,7 @@ export * from "./createembeddings.js";
 export * from "./createguardrail.js";
 export * from "./createimages.js";
 export * from "./createkeys.js";
+export * from "./createoauthtoken.js";
 export * from "./createobservabilitydestination.js";
 export * from "./createpresetschatcompletions.js";
 export * from "./createpresetsmessages.js";
@@ -74,6 +75,7 @@ export * from "./listkeyassignments.js";
 export * from "./listmemberassignments.js";
 export * from "./listmodelscount.js";
 export * from "./listmodelsuser.js";
+export * from "./listoauthjwks.js";
 export * from "./listobservabilitydestinations.js";
 export * from "./listorganizationmembers.js";
 export * from "./listpresets.js";

package/esm/models/operations/index.js

@@ -17,6 +17,7 @@ export * from "./createembeddings.js";
 export * from "./createguardrail.js";
 export * from "./createimages.js";
 export * from "./createkeys.js";
+export * from "./createoauthtoken.js";
 export * from "./createobservabilitydestination.js";
 export * from "./createpresetschatcompletions.js";
 export * from "./createpresetsmessages.js";
@@ -78,6 +79,7 @@ export * from "./listkeyassignments.js";
 export * from "./listmemberassignments.js";
 export * from "./listmodelscount.js";
 export * from "./listmodelsuser.js";
+export * from "./listoauthjwks.js";
 export * from "./listobservabilitydestinations.js";
 export * from "./listorganizationmembers.js";
 export * from "./listpresets.js";

package/esm/models/operations/listoauthjwks.d.ts

@@ -0,0 +1,53 @@
+import * as z from "zod/v4";
+export type ListOauthJwksGlobals = {
+    /**
+     * The app identifier should be your app's URL and is used as the primary identifier for rankings.
+     *
+     * @remarks
+     * This is used to track API usage per application.
+     */
+    httpReferer?: string | undefined;
+    /**
+     * The app display name allows you to customize how your app appears in OpenRouter's dashboard.
+     *
+     * @remarks
+     */
+    appTitle?: string | undefined;
+    /**
+     * Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings.
+     *
+     * @remarks
+     */
+    appCategories?: string | undefined;
+};
+export type ListOauthJwksRequest = {
+    /**
+     * The app identifier should be your app's URL and is used as the primary identifier for rankings.
+     *
+     * @remarks
+     * This is used to track API usage per application.
+     */
+    httpReferer?: string | undefined;
+    /**
+     * The app display name allows you to customize how your app appears in OpenRouter's dashboard.
+     *
+     * @remarks
+     */
+    appTitle?: string | undefined;
+    /**
+     * Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings.
+     *
+     * @remarks
+     */
+    appCategories?: string | undefined;
+};
+/** @internal */
+export type ListOauthJwksRequest$Outbound = {
+    "HTTP-Referer"?: string | undefined;
+    appTitle?: string | undefined;
+    appCategories?: string | undefined;
+};
+/** @internal */
+export declare const ListOauthJwksRequest$outboundSchema: z.ZodType<ListOauthJwksRequest$Outbound, ListOauthJwksRequest>;
+export declare function listOauthJwksRequestToJSON(listOauthJwksRequest: ListOauthJwksRequest): string;
+//# sourceMappingURL=listoauthjwks.d.ts.map

package/esm/models/operations/listoauthjwks.js

@@ -0,0 +1,20 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 63db6f2762a2
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../../lib/primitives.js";
+/** @internal */
+export const ListOauthJwksRequest$outboundSchema = z.object({
+    httpReferer: z.string().optional(),
+    appTitle: z.string().optional(),
+    appCategories: z.string().optional(),
+}).transform((v) => {
+    return remap$(v, {
+        httpReferer: "HTTP-Referer",
+    });
+});
+export function listOauthJwksRequestToJSON(listOauthJwksRequest) {
+    return JSON.stringify(ListOauthJwksRequest$outboundSchema.parse(listOauthJwksRequest));
+}
+//# sourceMappingURL=listoauthjwks.js.map

package/esm/models/tokenexchangerequest.d.ts

@@ -0,0 +1,92 @@
+import * as z from "zod/v4";
+import { ClosedEnum } from "../types/enums.js";
+/**
+ * Must be `urn:ietf:params:oauth:grant-type:token-exchange`.
+ */
+export declare const GrantType: {
+    readonly UrnIetfParamsOauthGrantTypeTokenExchange: "urn:ietf:params:oauth:grant-type:token-exchange";
+};
+/**
+ * Must be `urn:ietf:params:oauth:grant-type:token-exchange`.
+ */
+export type GrantType = ClosedEnum<typeof GrantType>;
+/**
+ * Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`.
+ */
+export declare const RequestedTokenType: {
+    readonly UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token";
+};
+/**
+ * Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`.
+ */
+export type RequestedTokenType = ClosedEnum<typeof RequestedTokenType>;
+/**
+ * Optional; only `inference` is available.
+ */
+export declare const Scope: {
+    readonly Inference: "inference";
+};
+/**
+ * Optional; only `inference` is available.
+ */
+export type Scope = ClosedEnum<typeof Scope>;
+/**
+ * Must be `urn:ietf:params:oauth:token-type:jwt`.
+ */
+export declare const SubjectTokenType: {
+    readonly UrnIetfParamsOauthTokenTypeJwt: "urn:ietf:params:oauth:token-type:jwt";
+};
+/**
+ * Must be `urn:ietf:params:oauth:token-type:jwt`.
+ */
+export type SubjectTokenType = ClosedEnum<typeof SubjectTokenType>;
+/**
+ * RFC 8693 token exchange request body (application/x-www-form-urlencoded).
+ */
+export type TokenExchangeRequest = {
+    /**
+     * The federation policy to evaluate, from Settings → Workload identity. Binds the exchange to one organization.
+     */
+    federationPolicyId: string;
+    /**
+     * Must be `urn:ietf:params:oauth:grant-type:token-exchange`.
+     */
+    grantType: GrantType;
+    /**
+     * Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`.
+     */
+    requestedTokenType?: RequestedTokenType | undefined;
+    /**
+     * Optional; only `inference` is available.
+     */
+    scope?: Scope | undefined;
+    /**
+     * The JWT issued by your identity provider.
+     */
+    subjectToken: string;
+    /**
+     * Must be `urn:ietf:params:oauth:token-type:jwt`.
+     */
+    subjectTokenType: SubjectTokenType;
+};
+/** @internal */
+export declare const GrantType$outboundSchema: z.ZodEnum<typeof GrantType>;
+/** @internal */
+export declare const RequestedTokenType$outboundSchema: z.ZodEnum<typeof RequestedTokenType>;
+/** @internal */
+export declare const Scope$outboundSchema: z.ZodEnum<typeof Scope>;
+/** @internal */
+export declare const SubjectTokenType$outboundSchema: z.ZodEnum<typeof SubjectTokenType>;
+/** @internal */
+export type TokenExchangeRequest$Outbound = {
+    federation_policy_id: string;
+    grant_type: string;
+    requested_token_type?: string | undefined;
+    scope?: string | undefined;
+    subject_token: string;
+    subject_token_type: string;
+};
+/** @internal */
+export declare const TokenExchangeRequest$outboundSchema: z.ZodType<TokenExchangeRequest$Outbound, TokenExchangeRequest>;
+export declare function tokenExchangeRequestToJSON(tokenExchangeRequest: TokenExchangeRequest): string;
+//# sourceMappingURL=tokenexchangerequest.d.ts.map

package/esm/models/tokenexchangerequest.js

@@ -0,0 +1,59 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 27152e05f952
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+/**
+ * Must be `urn:ietf:params:oauth:grant-type:token-exchange`.
+ */
+export const GrantType = {
+    UrnIetfParamsOauthGrantTypeTokenExchange: "urn:ietf:params:oauth:grant-type:token-exchange",
+};
+/**
+ * Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`.
+ */
+export const RequestedTokenType = {
+    UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token",
+};
+/**
+ * Optional; only `inference` is available.
+ */
+export const Scope = {
+    Inference: "inference",
+};
+/**
+ * Must be `urn:ietf:params:oauth:token-type:jwt`.
+ */
+export const SubjectTokenType = {
+    UrnIetfParamsOauthTokenTypeJwt: "urn:ietf:params:oauth:token-type:jwt",
+};
+/** @internal */
+export const GrantType$outboundSchema = z.enum(GrantType);
+/** @internal */
+export const RequestedTokenType$outboundSchema = z.enum(RequestedTokenType);
+/** @internal */
+export const Scope$outboundSchema = z.enum(Scope);
+/** @internal */
+export const SubjectTokenType$outboundSchema = z.enum(SubjectTokenType);
+/** @internal */
+export const TokenExchangeRequest$outboundSchema = z.object({
+    federationPolicyId: z.string(),
+    grantType: GrantType$outboundSchema,
+    requestedTokenType: RequestedTokenType$outboundSchema.optional(),
+    scope: Scope$outboundSchema.optional(),
+    subjectToken: z.string(),
+    subjectTokenType: SubjectTokenType$outboundSchema,
+}).transform((v) => {
+    return remap$(v, {
+        federationPolicyId: "federation_policy_id",
+        grantType: "grant_type",
+        requestedTokenType: "requested_token_type",
+        subjectToken: "subject_token",
+        subjectTokenType: "subject_token_type",
+    });
+});
+export function tokenExchangeRequestToJSON(tokenExchangeRequest) {
+    return JSON.stringify(TokenExchangeRequest$outboundSchema.parse(tokenExchangeRequest));
+}
+//# sourceMappingURL=tokenexchangerequest.js.map

package/esm/models/tokenexchangeresponse.d.ts

@@ -0,0 +1,36 @@
+import * as z from "zod/v4";
+import { ClosedEnum } from "../types/enums.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+export declare const IssuedTokenType: {
+    readonly UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token";
+};
+export type IssuedTokenType = ClosedEnum<typeof IssuedTokenType>;
+export declare const TokenType: {
+    readonly Bearer: "Bearer";
+};
+export type TokenType = ClosedEnum<typeof TokenType>;
+/**
+ * RFC 8693 token exchange response.
+ */
+export type TokenExchangeResponse = {
+    /**
+     * A short-lived JWT to send as `Authorization: Bearer` to the inference API.
+     */
+    accessToken: string;
+    /**
+     * Seconds until the access token expires: at most 15 minutes, and never later than the subject token expires.
+     */
+    expiresIn: number;
+    issuedTokenType: IssuedTokenType;
+    scope: string;
+    tokenType: TokenType;
+};
+/** @internal */
+export declare const IssuedTokenType$inboundSchema: z.ZodEnum<typeof IssuedTokenType>;
+/** @internal */
+export declare const TokenType$inboundSchema: z.ZodEnum<typeof TokenType>;
+/** @internal */
+export declare const TokenExchangeResponse$inboundSchema: z.ZodType<TokenExchangeResponse, unknown>;
+export declare function tokenExchangeResponseFromJSON(jsonString: string): SafeParseResult<TokenExchangeResponse, SDKValidationError>;
+//# sourceMappingURL=tokenexchangeresponse.d.ts.map

package/esm/models/tokenexchangeresponse.js

@@ -0,0 +1,36 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: e2774cad9e5e
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+export const IssuedTokenType = {
+    UrnIetfParamsOauthTokenTypeAccessToken: "urn:ietf:params:oauth:token-type:access_token",
+};
+export const TokenType = {
+    Bearer: "Bearer",
+};
+/** @internal */
+export const IssuedTokenType$inboundSchema = z.enum(IssuedTokenType);
+/** @internal */
+export const TokenType$inboundSchema = z.enum(TokenType);
+/** @internal */
+export const TokenExchangeResponse$inboundSchema = z.object({
+    access_token: z.string(),
+    expires_in: z.int(),
+    issued_token_type: IssuedTokenType$inboundSchema,
+    scope: z.string(),
+    token_type: TokenType$inboundSchema,
+}).transform((v) => {
+    return remap$(v, {
+        "access_token": "accessToken",
+        "expires_in": "expiresIn",
+        "issued_token_type": "issuedTokenType",
+        "token_type": "tokenType",
+    });
+});
+export function tokenExchangeResponseFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => TokenExchangeResponse$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'TokenExchangeResponse' from JSON`);
+}
+//# sourceMappingURL=tokenexchangeresponse.js.map

package/esm/sdk/apikeys.d.ts

@@ -19,14 +19,14 @@ export declare class APIKeys extends ClientSDK {
      * Create a new API key
      *
      * @remarks
-     * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret.
+     * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys). The optional `external` object associates the key with a partner-defined user and lookup key.
      */
     create(request: operations.CreateKeysRequest, options?: RequestOptions): Promise<operations.CreateKeysResponse>;
     /**
      * Delete an API key
      *
      * @remarks
-     * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+     * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
      */
     delete(request: operations.DeleteKeysRequest, options?: RequestOptions): Promise<operations.DeleteKeysResponse>;
     /**
@@ -40,7 +40,7 @@ export declare class APIKeys extends ClientSDK {
      * Update an API key
      *
      * @remarks
-     * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+     * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
      */
     update(request: operations.UpdateKeysRequest, options?: RequestOptions): Promise<operations.UpdateKeysResponse>;
 }

package/esm/sdk/apikeys.js

@@ -33,7 +33,7 @@ export class APIKeys extends ClientSDK {
      * Create a new API key
      *
      * @remarks
-     * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret.
+     * Create a new API key for the authenticated user. The plaintext `key` is returned only in this response. Treat it as a write-only, sensitive value; it cannot be retrieved later. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys). The optional `external` object associates the key with a partner-defined user and lookup key.
      */
     async create(request, options) {
         return unwrapAsync(apiKeysCreate(this, request, options));
@@ -42,7 +42,7 @@ export class APIKeys extends ClientSDK {
      * Delete an API key
      *
      * @remarks
-     * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+     * Delete an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
      */
     async delete(request, options) {
         return unwrapAsync(apiKeysDelete(this, request, options));
@@ -60,7 +60,7 @@ export class APIKeys extends ClientSDK {
      * Update an API key
      *
      * @remarks
-     * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys), or with a Connect client secret. A client secret reaches only the keys that same client created; any other key responds as if it does not exist.
+     * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
      */
     async update(request, options) {
         return unwrapAsync(apiKeysUpdate(this, request, options));

package/esm/sdk/oauth.d.ts

@@ -1,4 +1,5 @@
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 import type { CreateAuthorizationUrlRequest } from "../funcs/oAuthCreateAuthorizationUrl.js";
 import type { CreateSHA256CodeChallengeResponse } from "../funcs/oAuthCreateSHA256CodeChallenge.js";
@@ -42,5 +43,19 @@ export declare class OAuth extends ClientSDK {
      * Create an authorization code for the PKCE flow to generate a user-controlled API key
      */
     createAuthCode(request: operations.CreateAuthKeysCodeRequest, options?: RequestOptions): Promise<operations.CreateAuthKeysCodeResponse>;
+    /**
+     * OpenRouter access token signing keys
+     *
+     * @remarks
+     * RFC 7517 JWK Set containing the public keys OpenRouter signs access tokens with.
+     */
+    listOauthJwks(request?: operations.ListOauthJwksRequest | undefined, options?: RequestOptions): Promise<models.OAuthJwks>;
+    /**
+     * Exchange a workload identity token
+     *
+     * @remarks
+     * RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.
+     */
+    createOauthToken(request: operations.CreateOauthTokenRequest, options?: RequestOptions): Promise<models.TokenExchangeResponse>;
 }
 //# sourceMappingURL=oauth.d.ts.map

package/esm/sdk/oauth.js

@@ -3,7 +3,9 @@
  * @generated-id: 37b7f9b2970b
  */
 import { oAuthCreateAuthCode } from "../funcs/oAuthCreateAuthCode.js";
+import { oAuthCreateOauthToken } from "../funcs/oAuthCreateOauthToken.js";
 import { oAuthExchangeAuthCodeForAPIKey } from "../funcs/oAuthExchangeAuthCodeForAPIKey.js";
+import { oAuthListOauthJwks } from "../funcs/oAuthListOauthJwks.js";
 import { ClientSDK } from "../lib/sdks.js";
 import { unwrapAsync } from "../types/fp.js";
 import { oAuthCreateAuthorizationUrl } from "../funcs/oAuthCreateAuthorizationUrl.js";
@@ -63,5 +65,23 @@ export class OAuth extends ClientSDK {
     async createAuthCode(request, options) {
         return unwrapAsync(oAuthCreateAuthCode(this, request, options));
     }
+    /**
+     * OpenRouter access token signing keys
+     *
+     * @remarks
+     * RFC 7517 JWK Set containing the public keys OpenRouter signs access tokens with.
+     */
+    async listOauthJwks(request, options) {
+        return unwrapAsync(oAuthListOauthJwks(this, request, options));
+    }
+    /**
+     * Exchange a workload identity token
+     *
+     * @remarks
+     * RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.
+     */
+    async createOauthToken(request, options) {
+        return unwrapAsync(oAuthCreateOauthToken(this, request, options));
+    }
 }
 //# sourceMappingURL=oauth.js.map

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@openrouter/sdk",
-  "version": "1.2.98",
+  "version": "1.2.100",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrouter/sdk",
-  "version": "1.2.98",
+  "version": "1.2.100",
   "author": "OpenRouter",
   "description": "The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.",
   "keywords": [
@@ -21,8 +21,8 @@
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.22.0",
   "publishConfig": {
-    "provenance": true,
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "type": "module",
   "main": "./esm/index.js",
@@ -73,15 +73,15 @@
     "lint": "eslint --cache --max-warnings=0 src",
     "build": "tsc",
     "prepublishOnly": "npm run build",
+    "prepare": "npm run build",
     "test": "vitest --run --project unit",
-    "test:e2e": "vitest --run --project e2e",
     "typecheck": "tsc --noEmit",
     "typecheck:transit": "exit 0",
     "compile": "tsc",
-    "postinstall": "node scripts/check-types.js || true",
+    "test:e2e": "vitest --run --project e2e",
     "test:transit": "exit 0",
     "test:watch": "vitest --watch --project unit",
-    "prepare": "npm run build"
+    "postinstall": "node scripts/check-types.js || true"
   },
   "peerDependencies": {},
   "devDependencies": {