Expired API key returns misleading 401 "User not found" instead of "Key expired"

[monperrus]

API endpoint

Authenticated OpenRouter API requests (for example /api/v1/models and /api/v1/chat/completions)

Description

When an expired API key is used, the API currently returns:

{"message": "User not found.", "code": 401}

I would expect it to return a more accurate error such as:

{"message": "Key expired.", "code": 401}

Why this is a bug

User not found suggests the account does not exist or the token belongs to no user, which sends clients and users down the wrong debugging path.

If the actual failure mode is that the key exists but is expired, the error should say that explicitly so clients can distinguish between:

1. invalid / malformed key
2. revoked key
3. expired key
4. missing user / deleted account

Steps to reproduce

1. Create or use an API key with an expiration time
2. Wait until it expires
3. Call an authenticated endpoint with that key, for example:

curl -i https://openrouter.ai/api/v1/models \
  -H "Authorization: Bearer <expired_key>"

Actual behavior

{"message": "User not found.", "code": 401}

Expected behavior

{"message": "Key expired.", "code": 401}

Or, more generally, a distinct 401 error that correctly identifies key expiration.

Impact

This makes expired credentials harder to diagnose and can cause unnecessary support/debugging work in client apps and SDKs.