> This page is for Gateway.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Bring your own keys (BYOK)

> Connect your own AI vendor accounts to Gateway so requests are billed to your vendor account. Covers adding credentials, managed fallback, and which credentials requests use.

Bring your own keys (BYOK) lets Gateway call vendors with your own vendor account, keeping your negotiated pricing, quotas, and account controls. Your vendor bills you for tokens, and Merge charges only its [fee](/merge-gateway/cost/pricing).

Your application still calls Gateway with its Merge API key. You store one credential per vendor for your organization, and the usage settings below decide whether a request uses it. Gateway encrypts secrets and stores non-secret identifiers (such as a region or access key ID) in the clear.

> **Note**
>
> BYOK is available on the Pro and Enterprise plans, and adding or editing a credential needs the Manage credentials permission

## Add a credential

Open [**Configure → Vendor credentials**](https://gateway.merge.dev/configuration/vendor-credentials), find the vendor, select **Add key**, fill in the fields, and select **Add key** again, or call [`POST /v1/credentials`](/merge-gateway/management-api/credentials/create-credential). Only vendors that support BYOK are listed, and most need only an API key. Vertex AI needs a GCP project ID, a region, and a service account JSON with the Vertex AI User role, and Azure needs an API version and deployment name. [Amazon Bedrock](/merge-gateway/capabilities/byok/amazon-bedrock) has its own page.

Gateway doesn't test a credential on save, so send a request to a model on that vendor to confirm it works.

**Fall back to Merge managed credentials if this key fails** is on by default: a request that fails on your key retries on Merge-managed credentials. To rotate a key, edit the credential and enter the new secret; a blank field keeps the current one.

## Choose whose credentials requests use

Adding a credential doesn't make Gateway prefer it. The **Vendor credential usage** card on the same page sets eligible sources for two kinds of request:

| Requests                 | Options                                                                                                                                                                                                                |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Not linked to a customer | **Organization or Merge-managed credentials** (no preference), **Prefer organization credentials**, or **Organization credentials only**                                                                               |
| Linked to a customer     | Customer, organization, or Merge credentials with no preference; the customer's first, then organization, then Merge; customer or organization only; or customer only. A customer's own setting overrides this default |

**Organization credentials only** also turns off managed fallback on every credential. [Customer credentials](/merge-gateway/embedded-routing-stack/customer-keys) are added on the customer's page or through the API.

## Next steps

#### [Amazon Bedrock](/merge-gateway/capabilities/byok/amazon-bedrock)

Connect AWS with a Bedrock API key, access keys, or an IAM role

#### [Vendor terms](/merge-gateway/security/provider-terms)

Terms of service and serving region for each vendor