Bring your own keys (BYOK)
Bring your own keys (BYOK) lets Gateway call vendors with your own vendor account, keeping your negotiated pricing, quotas, and account controls. Your vendor bills you for tokens, and Merge charges only its fee.
Your application still calls Gateway with its Merge API key. You store one credential per vendor for your organization, and the usage settings below decide whether a request uses it. Gateway encrypts secrets and stores non-secret identifiers (such as a region or access key ID) in the clear.
BYOK is available on the Pro and Enterprise plans, and adding or editing a credential needs the Manage credentials permission
Add a credential
Open Configure → Vendor credentials, find the vendor, select Add key, fill in the fields, and select Add key again, or call POST /v1/credentials. Only vendors that support BYOK are listed, and most need only an API key. Vertex AI needs a GCP project ID, a region, and a service account JSON with the Vertex AI User role, and Azure needs an API version and deployment name. Amazon Bedrock has its own page.
Gateway doesn’t test a credential on save, so send a request to a model on that vendor to confirm it works.
Fall back to Merge managed credentials if this key fails is on by default: a request that fails on your key retries on Merge-managed credentials. To rotate a key, edit the credential and enter the new secret; a blank field keeps the current one.
Choose whose credentials requests use
Adding a credential doesn’t make Gateway prefer it. The Vendor credential usage card on the same page sets eligible sources for two kinds of request:
Organization credentials only also turns off managed fallback on every credential. Customer credentials are added on the customer’s page or through the API.