## Python SDK Changes:

* `open_router.o_auth.list_oauth_jwks()`: **Added**
* `open_router.o_auth.create_oauth_token()`: **Added**

Author: speakeasybot

.speakeasy/gen.lock

@@ -36,7 +36,7 @@ generation:
   documentation: mintlify
   preApplyUnionDiscriminators: true
 python:
-  version: 1.1.118
+  version: 1.1.119
   additionalDependencies:
     dev: {}
     main: {}

.speakeasy/gen.yaml

@@ -15088,6 +15088,83 @@ components:
         - 'code'
         - 'message'
       type: 'object'
+    OAuthErrorResponse:
+      description: 'RFC 6749 §5.2 error response.'
+      example:
+        error: 'invalid_grant'
+        error_description: 'The subject token was not accepted.'
+      properties:
+        error:
+          enum:
+            - 'invalid_request'
+            - 'invalid_grant'
+            - 'unsupported_grant_type'
+            - 'invalid_scope'
+            - 'server_error'
+            - 'temporarily_unavailable'
+          type: 'string'
+          x-speakeasy-unknown-values: allow
+        error_description:
+          type: 'string'
+      required:
+        - 'error'
+        - 'error_description'
+      type: 'object'
+    OAuthJwks:
+      description: 'RFC 7517 JWK Set of the keys OpenRouter signs access tokens with.'
+      example:
+        keys:
+          - alg: 'ES256'
+            crv: 'P-256'
+            kid: 'or-2026-09'
+            kty: 'EC'
+            use: 'sig'
+            x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU'
+            'y': 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0'
+      properties:
+        keys:
+          items:
+            additionalProperties: false
+            properties:
+              alg:
+                enum:
+                  - 'ES256'
+                type: 'string'
+              crv:
+                enum:
+                  - 'P-256'
+                type: 'string'
+              kid:
+                minLength: 1
+                type: 'string'
+              kty:
+                enum:
+                  - 'EC'
+                type: 'string'
+              use:
+                enum:
+                  - 'sig'
+                type: 'string'
+              x:
+                pattern: '^[A-Za-z0-9_-]+$'
+                type: 'string'
+              'y':
+                pattern: '^[A-Za-z0-9_-]+$'
+                type: 'string'
+            required:
+              - 'kty'
+              - 'crv'
+              - 'kid'
+              - 'x'
+              - 'y'
+              - 'alg'
+              - 'use'
+            type: 'object'
+          minItems: 1
+          type: 'array'
+      required:
+        - 'keys'
+      type: 'object'
     ObservabilityArizeDestination:
       example:
         api_key_hashes: null
@@ -25122,6 +25199,92 @@ components:
       example:
         format:
           type: 'text'
+    TokenExchangeRequest:
+      description: 'RFC 8693 token exchange request body (application/x-www-form-urlencoded).'
+      example:
+        federation_policy_id: '4b2f7d1e-8c3a-4e5f-9a6b-1c2d3e4f5a6b'
+        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange'
+        subject_token: '<jwt from your identity provider>'
+        subject_token_type: 'urn:ietf:params:oauth:token-type:jwt'
+      properties:
+        federation_policy_id:
+          description: 'The federation policy to evaluate, from Settings → Workload identity. Binds the exchange to one organization.'
+          example: '4b2f7d1e-8c3a-4e5f-9a6b-1c2d3e4f5a6b'
+          format: 'uuid'
+          type: 'string'
+        grant_type:
+          description: 'Must be `urn:ietf:params:oauth:grant-type:token-exchange`.'
+          enum:
+            - 'urn:ietf:params:oauth:grant-type:token-exchange'
+          example: 'urn:ietf:params:oauth:grant-type:token-exchange'
+          type: 'string'
+        requested_token_type:
+          description: 'Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`.'
+          enum:
+            - 'urn:ietf:params:oauth:token-type:access_token'
+          example: 'urn:ietf:params:oauth:token-type:access_token'
+          type: 'string'
+        scope:
+          description: 'Optional; only `inference` is available.'
+          enum:
+            - 'inference'
+          example: 'inference'
+          type: 'string'
+        subject_token:
+          description: 'The JWT issued by your identity provider.'
+          example: '<jwt from your identity provider>'
+          maxLength: 16384
+          minLength: 1
+          type: 'string'
+        subject_token_type:
+          description: 'Must be `urn:ietf:params:oauth:token-type:jwt`.'
+          enum:
+            - 'urn:ietf:params:oauth:token-type:jwt'
+          example: 'urn:ietf:params:oauth:token-type:jwt'
+          type: 'string'
+      required:
+        - 'grant_type'
+        - 'subject_token'
+        - 'federation_policy_id'
+        - 'subject_token_type'
+      type: 'object'
+    TokenExchangeResponse:
+      description: 'RFC 8693 token exchange response.'
+      example:
+        access_token: '<short-lived openrouter access token jwt>'
+        expires_in: 900
+        issued_token_type: 'urn:ietf:params:oauth:token-type:access_token'
+        scope: 'inference'
+        token_type: 'Bearer'
+      properties:
+        access_token:
+          description: 'A short-lived JWT to send as `Authorization: Bearer` to the inference API.'
+          example: '<short-lived openrouter access token jwt>'
+          type: 'string'
+        expires_in:
+          description: 'Seconds until the access token expires: at most 15 minutes, and never later than the subject token expires.'
+          example: 900
+          type: 'integer'
+        issued_token_type:
+          enum:
+            - 'urn:ietf:params:oauth:token-type:access_token'
+          example: 'urn:ietf:params:oauth:token-type:access_token'
+          type: 'string'
+        scope:
+          example: 'inference'
+          type: 'string'
+        token_type:
+          enum:
+            - 'Bearer'
+          example: 'Bearer'
+          type: 'string'
+      required:
+        - 'access_token'
+        - 'issued_token_type'
+        - 'token_type'
+        - 'expires_in'
+        - 'scope'
+      type: 'object'
     ToolCallStatus:
       enum:
         - 'in_progress'
@@ -36621,6 +36784,78 @@ paths:
       - $ref: "#/components/parameters/AppIdentifier"
       - $ref: "#/components/parameters/AppDisplayName"
       - $ref: "#/components/parameters/AppCategories"
+  /oauth/jwks:
+    get:
+      description: 'RFC 7517 JWK Set containing the public keys OpenRouter signs access tokens with.'
+      operationId: 'listOauthJwks'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthJwks'
+          description: 'JWK Set'
+        '500':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/InternalServerResponse'
+          description: 'Signing keys are not configured'
+      summary: 'OpenRouter access token signing keys'
+      tags:
+        - 'OAuth'
+    parameters:
+      - $ref: "#/components/parameters/AppIdentifier"
+      - $ref: "#/components/parameters/AppDisplayName"
+      - $ref: "#/components/parameters/AppCategories"
+  /oauth/token:
+    post:
+      description: 'RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.'
+      operationId: 'createOauthToken'
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/TokenExchangeRequest'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/TokenExchangeResponse'
+          description: 'Access token issued'
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'Malformed request, unsupported grant, or the subject token was not accepted'
+        '429':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'Rate limited'
+        '500':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'The token could not be issued'
+        '503':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'The issuer’s discovery document or JWKS could not be fetched'
+      summary: 'Exchange a workload identity token'
+      tags:
+        - 'OAuth'
+    parameters:
+      - $ref: "#/components/parameters/AppIdentifier"
+      - $ref: "#/components/parameters/AppDisplayName"
+      - $ref: "#/components/parameters/AppCategories"
   /observability/destinations:
     get:
       description: 'List the observability destinations configured for the authenticated entity''s default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace. Only destinations with stable release status are surfaced — destinations of other types are excluded. [Management key](/docs/guides/overview/auth/management-api-keys) required.'

.speakeasy/out.openapi.yaml

@@ -2,19 +2,19 @@ speakeasyVersion: 1.787.0
 sources:
     OpenRouter API:
         sourceNamespace: open-router-chat-completions-api
-        sourceRevisionDigest: sha256:7653bb5ddb5a2631fbafe215ee7a9cff39561fd3d4aac78269142fe5e9480f59
-        sourceBlobDigest: sha256:aa2090dae19b80edae917cc47934cfa0551033bb2e0e7f3900bebc99bf220cef
+        sourceRevisionDigest: sha256:548d52c5c213dc69da9a5075de144d2d234ae4a761b51515b9fb197d414e23b7
+        sourceBlobDigest: sha256:6f8a3a2bf9e6a014f1c0fe5e85415d4ba182afa6a3fadd5224480bf80f10bc51
         tags:
             - latest
             - 1.0.0
 targets:
     open-router:
         source: OpenRouter API
         sourceNamespace: open-router-chat-completions-api
-        sourceRevisionDigest: sha256:7653bb5ddb5a2631fbafe215ee7a9cff39561fd3d4aac78269142fe5e9480f59
-        sourceBlobDigest: sha256:aa2090dae19b80edae917cc47934cfa0551033bb2e0e7f3900bebc99bf220cef
+        sourceRevisionDigest: sha256:548d52c5c213dc69da9a5075de144d2d234ae4a761b51515b9fb197d414e23b7
+        sourceBlobDigest: sha256:6f8a3a2bf9e6a014f1c0fe5e85415d4ba182afa6a3fadd5224480bf80f10bc51
         codeSamplesNamespace: open-router-python-code-samples
-        codeSamplesRevisionDigest: sha256:4b44a31a05c14148f404504d497c148f0655682a8c6cd97a71d3ca6879fccbc0
+        codeSamplesRevisionDigest: sha256:b1caf408f8f4dbb6d7b94fb09bb1cc248275f7f241a09146682d20efe1e299b6
 workflow:
     workflowVersion: 1.0.0
     speakeasyVersion: 1.787.0

.speakeasy/workflow.lock

@@ -1969,4 +1969,14 @@ Based on:
 ### Generated
 - [python v1.1.118] .
 ### Releases
-- [PyPI v1.1.118] https://pypi.org/project/openrouter/1.1.118 - .
+- [PyPI v1.1.118] https://pypi.org/project/openrouter/1.1.118 - .
+
+## 2026-09-03 00:26:00
+### Changes
+Based on:
+- OpenAPI Doc  
+- Speakeasy CLI 1.787.0 (2.914.0) https://github.com/speakeasy-api/speakeasy
+### Generated
+- [python v1.1.119] .
+### Releases
+- [PyPI v1.1.119] https://pypi.org/project/openrouter/1.1.119 - .

RELEASES.md

@@ -0,0 +1,15 @@
+---
+title: "Alg"
+---
+
+## Example Usage
+
+```python
+from openrouter.components import Alg
+value: Alg = "ES256"
+```
+
+
+## Values
+
+- `"ES256"`

docs/components/alg.mdx

@@ -0,0 +1,15 @@
+---
+title: "Crv"
+---
+
+## Example Usage
+
+```python
+from openrouter.components import Crv
+value: Crv = "P-256"
+```
+
+
+## Values
+
+- `"P-256"`

docs/components/crv.mdx

@@ -0,0 +1,24 @@
+---
+title: "ErrorEnum"
+---
+
+## Example Usage
+
+```python
+from openrouter.components import ErrorEnum
+
+# Open enum: unrecognized values are captured as UnrecognizedStr
+value: ErrorEnum = "invalid_request"
+```
+
+
+## Values
+
+This is an open enum. Unrecognized values will not fail type checks.
+
+- `"invalid_request"`
+- `"invalid_grant"`
+- `"unsupported_grant_type"`
+- `"invalid_scope"`
+- `"server_error"`
+- `"temporarily_unavailable"`

docs/components/errorenum.mdx

@@ -0,0 +1,17 @@
+---
+title: "GrantType"
+---
+
+Must be `urn:ietf:params:oauth:grant-type:token-exchange`.
+
+## Example Usage
+
+```python
+from openrouter.components import GrantType
+value: GrantType = "urn:ietf:params:oauth:grant-type:token-exchange"
+```
+
+
+## Values
+
+- `"urn:ietf:params:oauth:grant-type:token-exchange"`

docs/components/granttype.mdx

@@ -0,0 +1,15 @@
+---
+title: "IssuedTokenType"
+---
+
+## Example Usage
+
+```python
+from openrouter.components import IssuedTokenType
+value: IssuedTokenType = "urn:ietf:params:oauth:token-type:access_token"
+```
+
+
+## Values
+
+- `"urn:ietf:params:oauth:token-type:access_token"`