diff --git a/README.md b/README.md
index d8a0fd5..f36a316 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,9 @@ To keep your API key secure, use one of the following methods:
     - Set an environment variable named `LLM_KEY` on your system.
     - The node will automatically pick it up if the UI field is empty.
 
+> [!NOTE]
+> If you've ever typed your key into the **api_key** field, clear it before saving the workflow — the value is stored in the workflow JSON. On Linux/macOS, restrict the JSON config with `chmod 600 openrouter_api_key.json` so only your user can read it.
+
 ### Inputs
 
 #### Required Inputs:
diff --git a/node.py b/node.py
index c7f4a09..cfa51fa 100644
--- a/node.py
+++ b/node.py
@@ -33,7 +33,8 @@ class OpenRouterNode:
     def __init__(self):
         self.chat_manager = ChatSessionManager()
 
-    def get_api_key(self, api_key_ui):
+    @staticmethod
+    def get_api_key(api_key_ui):
         """
         Resolves the API key from:
         1. UI input field (if not empty)
@@ -678,8 +679,9 @@ class OpenRouterNode:
 
         # Combine all relevant inputs into a tuple for comparison
         # Use primitive types where possible for reliable hashing/comparison
-        # Note: We don't hash the resolved API key from file/env to avoid re-running 
-        # if only the hidden key changes (which is rare), but we still pass the UI value.
+        # Note: api_key here is the UI value only. Keys resolved from the LLM_KEY
+        # env var or openrouter_api_key.json are intentionally NOT part of the
+        # cache key — they're treated as user environment, not workflow inputs.
         return (api_key, system_prompt, user_message_box, model,
                 web_search, cheapest, fastest, temp_float, pdf_engine, chat_mode,
                 aspect_ratio, image_resolution, seed, tuple(image_hashes), pdf_hash, user_message_input)