OpenRouter key is encrypted at rest. The browser never sees the plaintext again.