1. Why this feature earns its place

Every AI feature RecipeMemoir has (commentary, step rewrites, title checks, video and page import extraction, categorization, dedupe judging) runs today on the site's own OpenRouter key, plus Cloudflare Workers AI for photo generation and upscaling. At current personal scale that costs pennies. At product scale, AI compute is the only marginal cost that grows with enthusiasm: a user who loves the product is the most expensive user we have. That's backwards.

Letting a user paste their own OpenRouter key flips it:

• Their enthusiasm costs us nothing. A heavy AI user on their own key has zero marginal cost to us; the models we use cost them roughly half a cent per rewrite and fractions of a cent per commentary click.
• It's a natural premium fence. The pricing-tier design meters AI on the site key; "unlimited AI with your own key" slots cleanly into a paid tier without us eating the bill.
• It's an anti-lock-in story. "Your recipes are yours, and your AI is yours too" matches the brand promise that sells the product.

2. Where AI happens today (verified against the code)

All text-model traffic goes through exactly three networked functions; everything else reuses them. That's the whole refactor surface, and it's already funnel-shaped.

3. The design in one breath

One new module, one new table, one settings card, one resolution rule.

Provider resolution

A new lib/ai-credentials.mjs exposes one function the three call sites use instead of reading the environment directly: it returns the owner's stored key when one exists and works, otherwise the site key. Model choices stay server-controlled, always. The rewrite pipeline's integrity depends on the judge and the escalation being different model families from the rewriter; a user-configurable model list would quietly break the verify gate.

Key storage

New table user_ai_keys (migration 037): one row per user, the key encrypted at rest (AES-GCM via WebCrypto, with a new server secret), plus the last four characters for display and a working/failing status. The full key is never shown again after saving. Delete is instant and total. Keys are never logged, never in error messages, never in analytics.

Endpoints and settings

Save (with a live one-call test of the key), status, and delete, all gated on the owner's signed-in session, not the legacy editor key, because a billing credential is personal. The settings card shows "OpenRouter key ending in ...abcd, working, added July 21," with plain copy about what it costs, how it's stored, and how to remove it.

When a user's key dies

4. Pricing interplay

Metered AI on the site key stays the Free and Home Cook fence (AI photo counts, commentary caps). The user key then becomes one of two stories:

• Family-tier feature: "bring your key, no caps" is part of what the top tier sells; or
• Any-tier escape hatch: generosity story that kills the AI-cost objection at every level.

5. Build phases (no calendar promises, each shippable alone)

• Phase 1, plumbing: the credentials module threaded through the three call sites; behavior identical; full test suite stays green.
• Phase 2, storage: migration, endpoints, encryption round-trip tests, settings card, live key test on save.
• Phase 3, live: resolver prefers user keys; failing-key banner; guide entry.
• Phase 4, metering: only when tiers and checkout become real; usage rows per call, caps enforced on site-key calls only.

Verification each phase: unit tests on every pure helper, the site validator green, and one real end-to-end with a throwaway OpenRouter key, confirming on both OpenRouter dashboards that the user key carried the calls and the site key stayed quiet.

6. Honest risks

• Support surface: "my AI stopped working" tickets when user keys run dry. The failing-key banner and plain error copy soften this; they don't eliminate it.
• Onboarding friction: getting an OpenRouter key is a real hurdle for the Family Archivist demographic. This feature serves the enthusiast minority and must never become the only path to AI features, or it turns into a conversion killer. The metered site-key allowance is the mainstream path.
• Secret discipline: one sloppy log line can leak keys. The encryption module owns all key material end to end, and it's a code-review checklist item every phase.
• Scope guard: not multi-provider, not user model choice, not client-side AI calls. Any of those triples the surface for marginal value.