[Bug]: OpenRouter dictation always requires ZDR, so ElevenLabs BYOK keys on non-enterprise plans fail with a misleading error #34571

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. On OpenRouter, add an ElevenLabs BYOK key from a non-enterprise ElevenLabs plan (e.g. Creator) and set it to never fall back to OpenRouter's ElevenLabs capacity.
2. In T3 Code, Settings → Voice → Transcribe with → OpenRouter, model elevenlabs/scribe-v2, using an OpenRouter API key.
3. Dictate anything.

Expected behavior

The recording is transcribed through the BYOK key, or T3 lets me choose not to require zero data retention for my own key.

Actual behavior

Every cloud transcription fails, and T3 points at the wrong cause:

• With the BYOK key under OpenRouter's default ZDR setting, OpenRouter's request log shows a single ElevenLabs attempt failing with 403. T3 maps that to rejected-key, although both keys are valid.
• With the BYOK key marked "My account does not have ZDR", OpenRouter has no eligible endpoint. T3 maps the 404 to model-unavailable, and mobile shows "The chosen model isn't available on OpenRouter. Choose another model in Settings → Voice." Desktop/web only shows "Voice input failed".

Root cause: CloudSpeech.ts always sends provider: { zdr: true } (line 100) and filters the catalog with zdr=true (line 36), as introduced in #31769. For an ElevenLabs BYOK key, OpenRouter satisfies ZDR by calling ElevenLabs in zero-retention mode, which ElevenLabs only allows on enterprise or trial plans. Calling ElevenLabs directly with the same key reproduces it:

POST https://api.elevenlabs.io/v1/speech-to-text                        model_id=scribe_v2  -> 200
POST https://api.elevenlabs.io/v1/speech-to-text?enable_logging=false   model_id=scribe_v2  -> 403
{"detail":{"type":"authorization_error","code":"forbidden","message":"Only users from the enterprise or trial tier can use ZRM mode.","status":"not_allowed"}}

So any BYOK key whose provider gates ZDR behind an enterprise plan can never work with T3's OpenRouter dictation, and there is no setting to opt out.

Possible fix: a "Require zero data retention" setting for OpenRouter dictation, on by default. When it is off, T3 omits provider.zdr from the request and zdr=true from the catalog query. Separately, a 403 from OpenRouter could surface OpenRouter's error message instead of the generic rejected-key.

Impact

Major degradation or frequent failure

Version or commit

0.1.8-nightly.20261109.4429 (code references from main @ 7e565c5)

Environment

Linux server environment; Android app and Windows desktop as clients; OpenRouter → elevenlabs/scribe-v2 with ElevenLabs BYOK (Creator plan)

Workaround

Disable the BYOK key on OpenRouter (or allow OpenRouter's ElevenLabs capacity), so OpenRouter's own ZDR-enabled ElevenLabs account serves the request. Usage is then billed to OpenRouter credits instead of the ElevenLabs plan.