BYOK Vault

Bring your own provider key. The gateway calls that provider with your credentials, so usage bills to your provider account instead of your Synthorai balance — while routing, logging and the unified API stay the same.

In the console sidebar (it appears once the feature applies to your account): BYOK Keys Open it ↗

Steps

1. Open BYOK Keys and add a key for the provider you hold an account with.
2. Paste the provider key. It is encrypted at rest and never returned to the browser after saving.
3. Optionally limit it to specific models by listing their ids, comma-separated. Leave it empty and the key covers every model that provider serves.
4. Send a request and confirm on the provider's own dashboard that the usage landed there.

Limits and gotchas

• Your key is never shown again after saving — the vault stores it encrypted and only decrypts it in-flight to call the provider.
• Provider-side quotas become yours. Two caveats: the gateway applies its own per-model rate limit before it knows a request is BYOK, and BYOK usage still counts against a member's daily limit where the owner set one.
• Only the workspace owner can add, rotate or remove a BYOK key. Removing one makes the affected models fall back to shared credentials on the very next request.