Synthorai
Sign up free, 10 calls on us. Up to $1, no card needed. DeepSeek V4.1 Flash - 65% OFF Input, output and cached input. Eligibility applies.

BYOK Vault

Bring your own provider key. The gateway calls that provider with your credentials, so usage bills to your provider account instead of your Synthorai balance - while routing, logging and the unified API stay the same.

In the console sidebar (it appears once the feature applies to your account): BYOK Keys Open it ↗

Steps

  1. Open BYOK Keys and add a key for the provider you hold an account with.
  2. Paste the provider key. It is encrypted at rest and never returned to the browser after saving.
  3. Optionally limit it to specific models by listing their ids, comma-separated. Leave it empty and the key covers every model that provider serves.
  4. Send a request and confirm on the provider's own dashboard that the usage landed there.

Limits and gotchas

  • Your key is never shown again after saving - the vault stores it encrypted and only decrypts it in-flight to call the provider.
  • Provider-side quotas become yours. Two caveats: the gateway applies its own per-model rate limit before it knows a request is BYOK, and BYOK usage still counts against a member's daily limit where the owner set one.
  • Only the workspace owner can add, rotate or remove a BYOK key. Removing one makes the affected models fall back to shared credentials on the very next request.
  • Custom endpoints connect an endpoint you run or a provider plan, as long as it speaks the OpenAI Chat Completions, OpenAI Responses or Anthropic Messages API. Add one under Custom endpoints with a name, the API type, its base URL and key, and the models it takes over; with no models listed it takes over every model. Requests keep their model names, and the endpoint receives them as they are. These requests are not charged in credits and appear in Logs like any other. If the endpoint fails, Auto-fallback to Synthorai credits decides whether Synthorai answers instead. The address must be https and reachable from the public internet. If the endpoint does not list its models, Test connection sends one short request to the first model you list, on your own account; it appears in Logs as a Connection test.