Skip to main content
Private Models are available for Enterprise Plan customers. Talk to your OpenRouter account representative, or visit openrouter.ai/enterprise/form to learn about upgrading to Enterprise.
Private Models let you route to your own dedicated or fine-tuned deployment of a catalog model through OpenRouter, alongside the public models you already use. OpenRouter adds your deployment to that model’s provider list instead of creating a new model, so your team calls it with the same slug and API. Your private models and endpoints are only visible to the users and organizations you approve, and they will never show up in public model lists, rankings, search, charts, and benchmarks.

​
How it works

Once your private model endpoint is onboarded:
  • Approved users and organizations call it through the standard OpenRouter API, the same endpoints they use for public models (chat completions and responses).
  • The model slug behaves like any other OpenRouter model. It can be used with Model Fallbacks, Provider Selection, and other routing features.
  • Approved private endpoints are prioritized for callers with access, while public fallback candidates remain available if you list them.

​
Adding a private endpoint

A private endpoint must meet two requirements:
  • It is hosted by a provider that OpenRouter supports for BYOK, since requests are authenticated with your own provider key.
  • It serves a model that already exists in the OpenRouter catalog, with the same request and response shape and the same behaviors as that model. The private endpoint inherits the model’s slug and capabilities.
Organization admins on the Enterprise Plan can add private endpoints themselves from Settings > Private Endpoints. Each endpoint goes through four steps:
  1. Blueprint. Select the model from the catalog that your endpoint is providing, and the BYOK provider that hosts your capacity.
  2. Connect. Enter the HTTPS base URL of your endpoint and the upstream model or deployment ID it serves. You can also set pricing for cost reporting and declare whether the endpoint retains prompts (see ZDR).
  3. Test. OpenRouter sends a request to your endpoint using the provider key saved in one of your workspaces under BYOK. The checks confirm the key is accepted, the response is OpenAI-compatible, streaming works, usage fields are returned, and the served model ID matches what you entered.
  4. Activate. Once the checks pass, activation makes the model callable by workspaces in your organization.
Until it is activated, an endpoint stays hidden and is not routable. You can leave the wizard and resume setup later from the Private Endpoints list. Requests to a private endpoint are authenticated with your own provider key, so BYOK keys must be configured in each workspace that calls it.

​
Manage endpoints with the API or Terraform

You can also manage private endpoints programmatically, which helps when you run many of them or keep configuration in code. The Private Endpoints API covers the same lifecycle as the wizard: create, validate, activate, update pricing, disable, enable, and delete. Requests are authenticated with an organization Management API key. Keys created on a personal account are rejected, and the organization must have Private Endpoints enabled. The steps map to these calls:
  1. POST /api/v1/private-endpoints creates a hidden draft from model_permaslug, provider_slug, upstream_model_id, and, for providers that need it, base_url. You can also set pricing, declared_zdr, and declared_region.
  2. POST /api/v1/private-endpoints/{id}/validate runs the Test checks with the BYOK key saved in the workspace you pass as workspace_id. The workspace must belong to your organization and have a key for the endpoint’s provider.
  3. POST /api/v1/private-endpoints/{id}/activate makes a validated draft routable.
To do all three in one request, include activate: { "workspace_id": "..." } in the create body:
If validation fails, the draft is kept and returned with the failed checks. Fix it with PATCH /api/v1/private-endpoints/{id} (only drafts can be edited), then call /validate and /activate instead of creating it again. Send an Idempotency-Key header to make create retry-safe. Repeating a request with the same key returns the endpoint the first request created, and reusing the key with a different body returns 422 idempotency_key_reused. After activation, PUT /api/v1/private-endpoints/{id}/pricing updates the reported rates, and /disable and /enable stop or resume routing. DELETE /api/v1/private-endpoints/{id} removes an endpoint and stops routing to it. Pass draft_only=true to refuse the delete (409) if the endpoint has been activated.

​
Terraform

The OpenRouter Terraform provider includes an openrouter_private_endpoint resource built on the same API:
terraform apply creates, validates, and activates the endpoint. Changing pricing updates it in place, while changing the model, provider, base URL, upstream model ID, declarations, or activate workspace replaces it. terraform destroy disables and deletes it, and terraform import openrouter_private_endpoint.gpt4o <endpoint-id> adopts an endpoint that already exists.

​
Endpoint limit

Each organization can have up to 10 private endpoints by default. Every endpoint you have created counts toward the limit, including endpoints that are still hidden because setup is not finished. If you think you will need more than 10 private endpoints, talk to your OpenRouter account representative about raising the limit for your organization.

​
Who it’s for

Private Models is a good fit if:
  • You have a dedicated or fine-tuned deployment of a model in the OpenRouter catalog that you want to route through OpenRouter.
  • Your endpoint is OpenAI-compatible, or close enough that we can integrate it quickly.
  • You want your team or organization to access these models through OpenRouter without exposing them publicly.
  • You’re on the Enterprise Plan.

​
In-Region Routing

A private endpoint may be eligible for in-region routing when OpenRouter is able to derive a region from its base URL, or when you declare a data region during private-endpoint setup. Endpoints with neither are routed on the global openrouter.ai domain. See the In-Region Routing guide for supported providers.

​
Requesting access

Private Endpoints is an add-on to the Enterprise Plan. To enable it for your organization, reach out to your account representative. Once it is enabled, organization admins can add and manage endpoints from Settings > Private Endpoints.