The Zero-Dependency Sentry: How openrouter-webhook-logger Masters AI Observability

We needed a better way to track our OpenRouter spending, so we built this logger.

— EvanDataForge (Monitoring OpenRouter with Webhooks - EvanDataForge Blog)

The Art of the Zero-Vendor Folder

Modern web development often feels like a race to accumulate dependencies. A simple application can easily drag fifty megabytes of external code into its orbit. The OpenRouter Webhook Logger rejects this premise entirely. It is a defiant return to high-performance, zero-dependency PHP.

The architecture is designed to be unpacked and executed. There is no build step. There is no package manager. By relying solely on vanilla PHP and a MySQL connection, the project achieves an incredibly low footprint. This makes it ideal for shared hosting environments or edge deployments where resources are constrained.

This minimalist approach does not sacrifice capability. The logger solves a highly specific, modern problem. It captures observability data for AI model aggregators using bulletproof web patterns from the early internet.

Flattening the OTLP Labyrinth

OpenRouter emits data using the OpenTelemetry (OTLP) protocol. OTLP is powerful and highly extensible. It is also deeply nested and notoriously difficult to query directly. A single LLM generation payload arrives as a complex tree of spans and attributes.

This repository acts as a specialized protocol translator. The ingestion core intercepts the JSON payload and systematically shreds it. It extracts critical metadata like token counts, model names, and fractional cost metrics. It then maps these isolated variables into a flat, highly structured relational database schema.

The database schema itself takes on some of the computational load. It uses MySQL generated columns to automatically calculate total token counts on the fly. This keeps the application layer thin and ensures data integrity at the storage level.

Defense in Depth: The Dual-Auth Strategy

A public-facing webhook endpoint is a target. It must accept arbitrary POST requests while silently discarding malicious traffic. The logger implements a sophisticated dual-gatekeeper system to handle this threat.

The security module supports both HMAC-SHA256 signatures and static Bearer tokens. It uses constant-time hash comparisons to prevent timing attacks. Administrators can configure the system to require either method, or both simultaneously for maximum security.

This approach highlights a deep understanding of webhook lifecycle management. When an invalid signature is detected, the request is rejected and logged to a dedicated failure table. This provides immediate visibility into brute-force attempts without cluttering the primary trace data.

Developing in the Dark

Building a user interface for webhook data usually requires a live database and a constant stream of test events. The author bypassed this bottleneck entirely by building a decoupled development environment.

The repository includes a Python-based mock API. This tool generates synthetic OpenRouter traces and serves them directly to the frontend dashboard. Developers can iterate on the UI, adjust data formatting, and test error states without ever spinning up MySQL or touching the OpenRouter API.

The Lean Observability Stack

The market is flooded with webhook tools. Most fall into two categories. They are either lightweight local debuggers meant for temporary inspection, or massive enterprise gateways designed to route millions of events. This project carves out a highly specific middle ground.

It is not trying to be a general-purpose event bus. It is a specialized audit trail for AI spend. By focusing strictly on the OpenRouter OTLP schema, it provides immediate, actionable insights that generic loggers miss.

In an ecosystem obsessed with scale and abstraction, this repository offers a refreshing counter-narrative. It proves that complex data integration problems can still be solved with simple tools, clear boundaries, and a fundamental respect for computing resources.

Sources: EvanDataForge/openrouter-webhook-logger, EvanDataForge on X, EvanDataForge Blog.