OpenRouter's February 2026 Outages: How a Cold Cache Overwhelmed the Database

OpenRouter experienced two outages in February 2026, with the root cause being a cold cache overwhelming the database. The API reported that users did not exist, triggering a 401 error instead of the expected authentication failure. This distinction is crucial, as an authentication failure and an infrastructure failure are not the same thing. When the cache stopped serving database lookups, the database had to handle more work than usual, leading to a capacity problem.

The issue was further complicated by a concurrent denial-of-service attack during the first outage, which added to the investigation difficulties. However, the recurrence of the cache failure in February without the accompanying attack revealed the underlying cause. To prevent such issues in the future, circuit breakers and controlled cache repopulation are necessary.

Returning a 503 Service Unavailable response instead of a 401 Unauthorized error when an authentication lookup fails helps clients differentiate between an unavailable service and invalid credentials.

A useful test for any cache-backed authentication system is to invalidate the cache under realistic concurrency and observe the database's behavior during recovery. This helps determine how quickly load rises, whether concurrent misses are coalesced, if retries amplify the spike, and if the service can shed work before the database saturates. The full postmortem can be found at https://buildopsy.com/system-design/openrouter-cache-thundering-herd-postmortem.html.