Bring your own keys

With BYOK, you connect your own provider accounts and the gateway routes every request through them — so usage bills to your accounts and keys never go to a third party.

How keys are stored

• Keys are stored encrypted in AWS Secrets Manager and referenced by an opaque id in the database — the secret value is never stored in plaintext.
• Keys are scoped per organization, unique on (organization, provider, label), so you can register multiple keys per provider.
• Empty or whitespace-only keys are treated as absent to avoid malformed upstream requests.

Resolution order

For each request the gateway resolves a key in this order:

1. Tenant key — if your org has BYOK enabled for that provider.
2. Platform key — health-aware, subject to your tier's model access.
3. Environment fallback — provider environment variables, where configured.

The resolved source (tenant or platform) is recorded on the usage log for billing attribution.

Health tracking

Each key tracks a health status (healthy / degraded / unhealthy), a consecutive-error count and the last validation time. Errors increment the counter; a success resets it and flips the key back to healthy.

Manage keys in the dashboard under Settings → Provider Keys.