Your SmarterMail

Just the host. HTTPS is required; private/internal addresses are refused.

A domain admin signs in with their email address; a system admin with their admin username.

Sent once to your own server to get a token. Never stored, never logged, never written to disk.

Your OpenRouter key

Get one at openrouter.ai/keys. It stays in this browser tab (sessionStorage) and is sent straight to OpenRouter — this site's server never sees it and never pays for your tokens. Closing the tab forgets it.