Bring Your Own Keys: BYOK in Practice

BYOK (bring your own key) means your OpenAI, Anthropic, Google, or other provider keys plug into idapt, and matching requests bill straight to your provider accounts. You get the workspace; the tokens stay on your terms.

When BYOK is the right call

You have provider credits or committed spend to use up.
Your organization requires its own data agreements on model traffic.
You want provider-level rate limits and billing visibility for a workload.

And when it is not: if you just want simplicity, platform billing (one meter, prices shown in the app, no keys to rotate) is less to manage. The point is that it is a per-request routing decision, not a product choice.

Setting it up

Open the Gateway settings and add a provider connection with your key. Keys live in the encrypted secrets vault: never logged, never shown back.
Matching models route on your key from then on; replies attribute which lane served them.
Repeat per provider as needed. Local models via Ollama are the third lane: free and on your hardware.

The three lanes, together

A realistic setup: Anthropic traffic on your corporate key (data agreement), everything else on platform billing (simplicity), extraction jobs on a local model (free volume). One workspace, three billing realities, chosen per request by routing rules rather than by juggling apps.

Good to know

BYOK requests are not metered against platform usage; your provider's own limits apply instead.
Custom OpenAI-compatible endpoints connect the same way, including self-hosted servers.
The gateway's OpenAI-compatible API works with BYOK too: your code, your keys, the whole catalog's interface.
What is BYOK covers the concept; the AI Gateway feature page covers governance (allow-lists, workspace ceilings).

If you already pay a provider directly, connect that key first and watch the attribution on your next few replies: the routing is visible, which is what makes it trustworthy.

When BYOK is the right call

You have provider credits or committed spend to use up.
Your organization requires its own data agreements on model traffic.
You want provider-level rate limits and billing visibility for a workload.

Setting it up

Open the Gateway settings and add a provider connection with your key. Keys live in the encrypted secrets vault: never logged, never shown back.
Matching models route on your key from then on; replies attribute which lane served them.
Repeat per provider as needed. Local models via Ollama are the third lane: free and on your hardware.

The three lanes, together

Good to know

BYOK requests are not metered against platform usage; your provider's own limits apply instead.
Custom OpenAI-compatible endpoints connect the same way, including self-hosted servers.
The gateway's OpenAI-compatible API works with BYOK too: your code, your keys, the whole catalog's interface.
What is BYOK covers the concept; the AI Gateway feature page covers governance (allow-lists, workspace ceilings).

If you already pay a provider directly, connect that key first and watch the attribution on your next few replies: the routing is visible, which is what makes it trustworthy.