Skip to main content
Add your provider credential once, then call models with your impossibl API key as usual. Requests served by your credential cost 0 gateway credits; the provider bills you directly. In the console, open api keys, then byok. You can also add credentials through the API below.
Other configured routes can still use paid gateway credentials. Review routing and failover if you need to understand when a request may consume credits.

​
Add a credential

The body shape depends on provider:An optional label names the credential for your own reference. The credential is verified live before being stored — a bad key or a typo’d Azure resource name is rejected immediately with the provider’s own error, nothing is persisted. For azure and azure-foundry, every entry in modelDeployments gets its own live check (not just the first), and for bedrock every catalog model your region offers does — the credential is stored as long as at least one model works, and the response’s model_availability reports which ones are actually good.Azure only: deployment names are whatever you named them in your own Azure resource, so the gateway can’t infer which deployment serves which model. Map it explicitly with modelDeployments, keyed by the gateway’s model id:
A request for openai/gpt-5.4 then routes to my-gpt5-deployment on your Azure resource. A model with no entry in the map skips this BYOK route. Another configured route may serve it and consume gateway credits.Keys must be full gateway model ids, namespace included — openai/gpt-5.4, not gpt-5.4. A key we don’t serve is rejected when you add the credential rather than stored as a mapping nothing can ever match.Azure AI Foundry only: endpoint accepts any of the five shapes Azure hands you — paste it exactly as shown in the portal:
  • Azure OpenAI resource: https://<resource>.openai.azure.com/ — the bare endpoint from your resource’s Keys and Endpoint page, no path or api-version to add.
  • Serverless model catalog (Llama, Mistral, Phi, etc.): https://<resource>.<region>.inference.ai.azure.com
  • Unified project/hub endpoint: https://<resource>.services.ai.azure.com/models/chat/completions?api-version=2024-05-01-preview
  • Shared regional Cognitive Services endpoint (same Model Inference API as the one above, on the operator’s own regional host): https://<region>.api.cognitive.microsoft.com/models/chat/completions?api-version=2024-05-01-preview
  • Classic/modern Azure OpenAI resource (Responses API): https://<resource>.cognitiveservices.azure.com/openai/responses?api-version=2025-04-01-preview — this one speaks the OpenAI Responses API, a different wire format from the other three Chat Completions shapes; the gateway handles the difference for you.
The gateway detects which shape you gave it from the hostname and path. .openai.azure.com and .cognitiveservices.azure.com are two hostnames for the same resource and work interchangeably. Everything except the serverless shape and the Azure OpenAI resource endpoint requires the api-version query parameter; a missing one is rejected at submission time.Unlike Azure OpenAI, modelDeployments is optional here — Foundry deployments keep their catalog model name unless you rename them, so the gateway tries every one of its registered Foundry-native models (Llama-3.3-70B-Instruct, Mistral-Large-2411, Phi-4, deepseek-v4-flash, deepseek-v4-pro, deepseek-v3-2, deepseek-v3-2-speciale) against your endpoint and keeps whichever respond:
Two cases still need an explicit modelDeployments entry (same syntax as Azure OpenAI above): a deployment you renamed, and models that already have a native route through another provider (e.g. openai/gpt-5.4). An explicit mapping always wins over auto-detection, and a model with no mapping at all falls back to the gateway’s own (shared-key) route, if one is configured.Bedrock only: apiKey is a Bedrock API key (from the Bedrock console’s API keys page) — a bearer token, not an IAM access key ID/secret pair. region must be the same AWS region the key was generated for (e.g. eu-west-3), and must be in the us-*, eu-*, or ap-* region groups — any other region is rejected when you add the credential. Requests route to the same geography your key lives in.You don’t map Bedrock models yourself. When you add the key, the gateway lists the models Bedrock offers in your region, matches them to our catalog, and sends each match one minimal request (billed to your AWS account, a fraction of a cent in total). The models that answer are stored as the credential’s model_deployments, and your key is used for exactly those — including Claude models the gateway doesn’t itself serve through Bedrock. A model your account can’t call is never sent to your key. If you enable more models in AWS later, refresh the credential (below).
The response never includes the credential you submitted:
For azure/azure-foundry, the response also includes model_availability, keyed by gateway model id — for azure-foundry this includes any auto-detected catalog matches alongside whatever you explicitly mapped:
Submitting again for the same provider replaces the existing credential in place.

​
Refresh

Re-runs the live check against the credential you already stored — no need to send the key again — and replaces its model_deployments with what it can serve now, returning the same shape as above with model_availability. For bedrock this re-detects every model; for azure/azure-foundry it re-checks the mappings already stored. If nothing verifies, the stored list is left as it was and the error is returned. The console’s byok list has a refresh button on each key that does the same.

​
List and remove

GET returns the same redacted shape as above for every credential you’ve added (any status). DELETE revokes one — matching requests fall back to the gateway’s shared key (or 503 provider_not_configured if none is set up for that provider).

​
Routing precedence

Your own credentials always go first. For each request, every route your BYOK credentials can serve is tried before any route on the gateway’s shared credentials, whatever order the model’s routes are declared in; the shared routes follow as the paid fallback.
  • A matching BYOK credential replaces the shared credential for its route; it does not replace every route for the model.
  • Azure, Azure Foundry and Bedrock credentials serve only the models in their model_deployments. A model missing from it skips your credential; it does not blend with the shared credential in the same route slot.
  • If a route fails before output begins, another configured route can serve the request. See routing.
  • Speed tiers use only their native credential: Anthropic for Fast, OpenAI for Ultrafast. Azure, Azure Foundry and Bedrock credentials never serve these tiers. Both deduct 0 gateway credits with BYOK.

​
Billing

Requests served by your own credential deduct 0 credits and still appear in usage and request logs. A request served by a shared gateway route is billed at the model’s published rate. The balance check is skipped only when all resolved routes are BYOK. If the route list contains a paid fallback, the request must pass the balance check before generation, even if the first route is BYOK. Adding a provider key alone does not guarantee zero-balance access. Check the request log’s byok, provider, and costCredits fields to confirm how a request was served.