Fields
| HTTP-Referer | request header | your app's URL, truncated to 500 chars (falls back to the standard Referer header) |
| X-Title | request header | your app's display name, truncated to 200 chars (also accepts X-OpenRouter-Title) |
| user | request body | your own opaque end-user id, truncated to 64 chars — the same field name the OpenAI API uses |
All three are advisory only — client-set, spoofable, and never used as an auth signal or a billing boundary. They exist purely so usage rolls up the way you actually think about your traffic.
Where it shows up
Every trace stores app_name,
app_referer, and
end_user alongside the usual cost and
routing fields — browsable per-request at /logs,
and aggregated by end-user via the management API's usage-by-end-user breakdown that backs your
/usage dashboard.