Bring your own key (BYOK)

Already have direct contracts with OpenAI, Anthropic, AWS Bedrock, Google Vertex, or Azure OpenAI? Bring those keys into AIgateway and pay the provider directly — you keep your negotiated rate, committed-spend discount, or HIPAA contract. We only charge a flat $0.20 per 1M routed tokens for routing + observability. No per-token markup.

Adding a provider key

1. Dashboard → Providers → Add key.
2. Pick the provider, paste the secret, optionally scope it to a project.
3. Keys are sealed with envelope encryption (per-tenant DEK, KMS-wrapped) and never returned by our API after creation.

How routing works with BYOK

When a request hits a model that has your own key attached, we:

1. Decrypt your key in a request-scoped isolate (never logged, never persisted).
2. Forward to the provider with your key on the Authorization header.
3. Record usage, latency, and billing metadata against your account — not the provider bill.
4. Charge you the flat BYOK routing fee (debited from prepaid balance).

Supported providers

Override per-request

{
  "model": "openai/gpt-5.4",
  "provider_key_id": "pk_01HQE...3K",
  "messages": [...]
}

Rotation + revocation

Rotate a key by adding the new secret and marking the old one revoked — new requests use the newer key, in-flight requests finish on the old one. Revoked keys are purged within 15 minutes.

Billing treatment

• The gateway fee ($0.20 per 1M routed tokens) comes out of your prepaid balance.
• The inference cost hits your provider bill directly — we never see it.
• Free-tier quotas do not apply to BYOK requests. You can mix BYOK and managed keys freely on the same account.