feat: Externalize default OpenRouter API key to environment variable and ignore .env.production.

.env.production

@@ -1,34 +0,0 @@
-MODE="production"
-
-VITE_APP_BACKEND_V2_GET_URL=https://json.excalidraw.com/api/v2/
-VITE_APP_BACKEND_V2_POST_URL=https://json.excalidraw.com/api/v2/post/
-
-VITE_APP_LIBRARY_URL=https://libraries.excalidraw.com
-VITE_APP_LIBRARY_BACKEND=https://us-central1-excalidraw-room-persistence.cloudfunctions.net/libraries
-
-VITE_APP_PLUS_LP=https://plus.excalidraw.com
-VITE_APP_PLUS_APP=https://app.excalidraw.com
-
-VITE_APP_AI_BACKEND=https://oss-ai.excalidraw.com
-
-# socket server URL used for collaboration
-VITE_APP_WS_SERVER_URL=https://oss-collab.excalidraw.com
-
-VITE_APP_FIREBASE_CONFIG='{"apiKey":"AIzaSyAd15pYlMci_xIp9ko6wkEsDzAAA0Dn0RU","authDomain":"excalidraw-room-persistence.firebaseapp.com","databaseURL":"https://excalidraw-room-persistence.firebaseio.com","projectId":"excalidraw-room-persistence","storageBucket":"excalidraw-room-persistence.appspot.com","messagingSenderId":"654800341332","appId":"1:654800341332:web:4a692de832b55bd57ce0c1"}'
-
-VITE_APP_ENABLE_TRACKING=false
-
-VITE_APP_PLUS_EXPORT_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApQ0jM9Qz8TdFLzcuAZZX
-/WvuKSOJxiw6AR/ZcE3eFQWM/mbFdhQgyK8eHGkKQifKzH1xUZjCxyXcxW6ZO02t
-kPOPxhz+nxUrIoWCD/V4NGmUA1lxwHuO21HN1gzKrN3xHg5EGjyouR9vibT9VDGF
-gq6+4Ic/kJX+AD2MM7Yre2+FsOdysrmuW2Fu3ahuC1uQE7pOe1j0k7auNP0y1q53
-PrB8Ts2LUpepWC1l7zIXFm4ViDULuyWXTEpUcHSsEH8vpd1tckjypxCwkipfZsXx
-iPszy0o0Dx2iArPfWMXlFAI9mvyFCyFC3+nSvfyAUb2C4uZgCwAuyFh/ydPF4DEE
-PQIDAQAB'
-
-# Set the below flags explicitly to false in production mode since vite loads and merges .env.local vars when  running the build command
-VITE_APP_DEBUG_ENABLE_TEXT_CONTAINER_BOUNDING_BOX=false
-VITE_APP_COLLAPSE_OVERLAY=false
-# Enable eslint in dev server
-VITE_APP_ENABLE_ESLINT=false
-

.gitignore

@@ -35,3 +35,4 @@ excalidraw-app/android/local.properties
 
 # Docker build output
 output/
+.env.production

packages/excalidraw/data/ai/openrouter.ts

@@ -12,11 +12,19 @@ export interface OpenRouterResponse {
 
 export const OPENROUTER_API_URL = "https://openrouter.ai/api/v1/chat/completions";
 export const DEFAULT_OPENROUTER_MODEL = "anthropic/claude-sonnet-4.5";
-export const DEFAULT_OPENROUTER_API_KEY = "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";
+
+// Default API key from environment variable (set in .env.local)
+const getDefaultApiKey = (): string | null => {
+    // Check if running in browser with Vite
+    if (typeof import.meta !== 'undefined' && import.meta.env) {
+        return import.meta.env.VITE_APP_OPENROUTER_API_KEY || null;
+    }
+    return null;
+};
 
 export class OpenRouterClient {
     static getApiKey(): string | null {
-        return EditorLocalStorage.get(EDITOR_LS_KEYS.OPENROUTER_API_KEY) || DEFAULT_OPENROUTER_API_KEY;
+        return EditorLocalStorage.get(EDITOR_LS_KEYS.OPENROUTER_API_KEY) || getDefaultApiKey();
     }
 
     static setApiKey(key: string) {