docs(openrouter-oauth): sync with openrouter-web changes

[devin-ai-integration]

Summary

OpenRouter now supports a headless authorization mode that the skill did not teach. Source: openrouter-web #32412 (projects/docs/guides/overview/auth/oauth.mdx, projects/web/app/(oauth)/auth/page.tsx).

Omitting callback_url from the authorize URL puts the page into display-code mode: after approval the authorization code is rendered on screen for the user to paste into a CLI, instead of a redirect.

https://openrouter.ai/auth?code_challenge=<challenge>&code_challenge_method=S256&key_label=<label>

Constraints documented, taken from the gate in page.tsx:

• code_challenge is required and code_challenge_method must be S256; plain is rejected because the challenge sits in the URL of the same screen that renders the code.
• oauth_client_id must not be present. A rejected request redirects to the OpenRouter home page rather than showing a code.
• key_label sets the app title on the approval screen, defaulting to A command-line app.
• The code is single-use and expires ten minutes after issuance.
• The POST /api/v1/auth/keys exchange is unchanged.

Also noted that the drop-in browser auth module's sessionStorage/localStorage handling does not apply in CLI/Node — the verifier only needs to survive in the process until the user pastes the code back — and widened the frontmatter compatibility and README.md compatibility line, which claimed browser-only. Version bumped to 2.1.0.

Since the skill now claims CLI/Node support, the headless section also carries a dependency-free Node example (verifier and S256 challenge via node:crypto, authorize URL, pasted code from stdin, fetch exchange), so the "copy-pasteable, no dependencies" promise covers that environment rather than leaving base64url encoding to the reader. It was run as written on Node LTS through to the live exchange, and its base64url output was checked against the browser module's encoding for identical input bytes.

Link to Devin session: https://openrouter.devinenterprise.com/sessions/16f2009a79af4b1fb44a86c0810f07ba

[devin-ai-integration]

Original prompt from Automation

You are the public skills sync pipeline. Your job is to scan PRs merged to main on OpenRouterTeam/openrouter-web in the last 24 hours, determine if any changes warrant updating the public agent skills in OpenRouterTeam/skills, and open PRs to the skills repo when updates are needed.

#``# Step 1: Identify relevant merged PRs

Clone both repos:

cd /home/ubuntu/repos/openrouter-web
git fetch origin main
git log --since='24 hours ago' --merges --first-parent origin/main --pretty=format:'%H|%s' --name-only

For each merged PR, collect the list of changed files. Only PRs that touch the paths in the mapping below are relevant. Skip bot commits (devin-ai-integration[bot], Devin AI, GitHub Actions Bot, openrouter[bot], opencode-agent[bot], OpenRouter SDK Bot, Claude, detail-app[bot], forge-the-devex-intern[bot], dependabot[bot]).

If no relevant PRs were merged, post a short message to the #devrel Slack channel (C08LQFVSC7Q) saying no skill-relevant changes were detected today, and exit.

#``# Step 2: Map changed files to affected skills

Use this mapping to determine which public skills are potentially affected:

openrouter-web paths	Affected skill(s) in OpenRouterTeam/skills
sdks/typescript/, packages/llm-interfaces/	openrouter-typescript-sdk, openrouter-agent-migration
services/cfw-*/src/routes/*analytics*, analytics query/response schemas	openrouter-analytics, openrouter-analytics-query, openrouter-analytics-schema
Generation routes, /api/v1/generation	openrouter-generations
Image generation adapters, packages/image-generation/	openrouter-images
supabase/seeds/, model schemas, /api/v1/models route	openrouter-models
OAuth/auth routes, PKCE flow code	openrouter-oauth
STT adapters, services/cfw-stt-api/, /api/v1/audio/transcriptions	openrouter-stt
TTS routes, /api/v1/audio/speech	openrouter-tts
Video adapters, /api/v1/videos	openrouter-video
``@`openr... (3383 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[perry-the-pr-maintainer]

Perry's Review

Verdict: ✅ LGTM

Risk: 🟢 Low

Review of docs(openrouter-oauth): sync with openrouter-web changes

Auto-review triggered by pull_request.opened. PR is OPEN, not draft, and no prior Perry review exists on head 5c4247b — guards passed.

What changed

Docs-only sync for the openrouter-oauth skill (+25/-5, 2 files). It documents the new headless / no-callback authorization mode added to openrouter-web in OpenRouterTeam/openrouter-web#32412:

• SKILL.md: version 2.0.0 → 2.1.0; frontmatter description and compatibility widened to cover CLI/Node.js; decision-tree row for "Get an API key programmatically (no UI)" now points at the headless flow; a new "Headless / no-callback flow" section with the authorize URL, param table, and constraints.
• README.md: compatibility line and "What it covers" list updated to match.

Spec verification — claims checked against the implementation

I cloned the cited openrouter-web PR (#32412, merged) and read its auth-page gate and the consent-section UI. Every documented claim matches the merged code:

Claim in SKILL.md	Implementation (openrouter-web)	✓
Omitting callback_url → code rendered on screen	no-callback branch renders the auth code in a code block for the user to paste	✓
code_challenge required	missing challenge → redirect to home	✓
code_challenge_method must be S256; plain rejected	method ≠ S256 → redirect; the code comment confirms plain is rejected because the challenge sits in the URL of the same screen that renders the code	✓
oauth_client_id must not be present	client-id present → redirect	✓
Rejected request → OpenRouter home page	both rejection branches redirect('/', replace)	✓
key_label sets app title; defaults to A command-line app	keyLabelParam ?? 'A command-line app'	✓
Code single-use, expires 10 min	UI copy "used once and expires after 10 minutes"; the public docs guide matches	✓
POST /api/v1/auth/keys exchange unchanged	display-code only changes code delivery, not the key-exchange request	✓

No CI checks are configured for this repo (statusCheckRollup empty), so there is no CI gate to report. No prior review threads exist.

Findings

Suggestion (non-blocking) — see inline on SKILL.md line 66: the skill now advertises CLI/Node.js support, but the only copy-pasteable code remains the browser auth module (window/btoa/sessionStorage/crypto.subtle). A minimal Node PKCE snippet (verifier + S256 challenge via node:crypto/crypto.webcrypto, reading the pasted code, and the fetch exchange) would extend the skill's "copy-pasteable, no dependencies" promise to the newly claimed environment and remove the base64url-encoding risk it exists to prevent. Not a blocker — the prose constraints are correct and sufficient for an agent to synthesize the code.

Observation (not inline) — the decision-tree row "Get an API key programmatically (no UI)" was narrowed from "Just implement the PKCE flow — skip the button section" to "Use the headless / no-callback flow below". The "(no UI)" qualifier makes headless the right target, but a web app that wants programmatic keys with a callback no longer has an explicit pointer. Worth a moment of thought, but consistent with the reframe and not misleading.

Risk assessment

Risk: 🟢 Low

Risk assessment:

Dimension	Severity	Risk	Reasoning
Implementation risk	🟩	Low	Docs-only; every behavioral claim was verified line-by-line against the merged openrouter-web gate.
Premise risk	🟩	Low	The premise (sync the skill with the merged headless-auth capability) is correct and the cited PR is merged.
Estimated impact	🟩	Low	Worst case is a CLI author writing their own PKCE glue from correct constraints; no production, security, or data impact from the doc itself.

Risk Factor	Severity	Risk	Reasoning
Reversibility	🟩	Low	Markdown docs; trivially revertable.
Detectability	🟩	Low	Inaccuracies would surface the next time someone follows the flow against live behavior.
Blast radius	🟩	Low	Contained to the openrouter-oauth skill; no other skill references these params.
Data integrity		None	No persisted state is touched by a docs change.
Financial exposure		None	No billing/payment surface involved.
Security and privacy exposure	🟩	Low	Doc correctly mandates S256 for display-code mode and gives sound verifier-handling guidance; no auth-weakening.
Propagation	🟩	Low	Agents consuming the skill inherit accurate constraints.
Availability		None	Cannot affect whether anything serves.
Recovery cost	🟩	Low	A doc fix is a one-line PR.
Time to correct	🟩	Low	Minutes to amend markdown.