If you see OpenRouter charges you don't recognize and the only clue is something like "VSCODE" or an editor name, the usage almost always came from an AI coding extension running in your editor. These tools call models through your OpenRouter API key, and a single session can send a lot of tokens.
Why this happens
AI coding assistants — Cline, Roo Code, Kilo Code, Continue, and similar — use your API key to make model requests as you work. Costs add up fast when:
- The extension sends your whole repository or large files as context on every request.
- An agent mode loops, retrying or chaining many calls automatically.
- It's pointed at an expensive model for routine edits.
- It keeps running in the background after you've stopped paying attention.
Confirm where the charges came from
- Open your Activity page. It shows each request, the model used, the token counts, and the app or key that made the call.
- Look at which API key was used and which model. Editor extensions usually show up as a steady stream of requests on one key.
Stop it right now
- Go to your API keys page and disable or delete the key the extension is using. That immediately stops any further charges on it.
- In your editor, turn off the extension or sign it out of OpenRouter.
Prevent it going forward
- Set a credit limit on the key the extension uses, so it can never spend more than you intend. You can do this when you create a key or by editing an existing one.
- Create a separate, limited key for each tool instead of reusing one key everywhere.
- Turn on usage notifications and check your Activity page periodically.
- In the extension's settings, point it at a cheaper model and trim how much context it sends.
Were the charges real usage?
Charges that match real requests on your Activity page reflect usage that already happened, so they aren't automatically reversed. The steps above stop further spend and keep it from recurring. If you believe the charges are the result of unauthorized access to your account or key, contact OpenRouter Support and we'll investigate.