The OpenRouter key ladder uses OPENAI_API_KEY for an OpenRouter-context endpoint only when it matches OPENAI_BASE_URL, but the match compared hostnames. A mirror on the same host over http://, or on another port, received the key. Compare utils.base_url_origin (scheme, host, effective port). Any OPENAI_BASE_URL with a host still binds the key; one whose port does not parse binds it and matches nothing.
(cherry picked from commit c9fce525284ae7a970c873f9b1cf969c8a5522ba)