Bring your own keys (BYOK)
Bring your own keys (BYOK)
Bring your own keys (BYOK) lets you connect your own AI provider accounts to Gateway. When a credential is set for a provider, Gateway signs requests to that provider with your key, so usage, quota, and data land on your account instead of Merge managed access. Use it when you have negotiated provider pricing you want to keep, when compliance requires model traffic to run on your own cloud account, or when you want provider-side controls like your own logging and rate limits.
How it works
You store one BYOK credential per provider, per organization. The secret portion (an API key, a secret access key, or a service account) is encrypted before storage, while non-secret identifiers like a region or an access key ID are stored in the clear. At request time, Gateway looks up the credential for the routed provider and uses it to authenticate the call.
If a request routes to a provider you have not configured, or your credential fails, Gateway falls back to Merge managed access when the credential’s Fall back to Merge managed credentials option is on. Turn it off if you want requests to fail rather than run on managed access.
BYOK is available on the Pro and Enterprise plans. You need the manage-credentials permission to add or edit a credential.
Add a credential
- In the Gateway dashboard, open Configuration and go to the provider credentials (BYOK) section
- Choose Add, then select the provider
- Enter the credential (most providers take a single API key, while Amazon Bedrock and Vertex AI use a provider-specific shape)
- Leave Fall back to Merge managed credentials on unless you want requests to fail when your key does
- Choose Add key
The credential takes effect on your next request to that provider. To rotate a key, edit the credential and enter the new secret. Leave the secret field blank to keep the current one.