Bring your own key (BYOK)

You can add your own provider API keys (OpenAI, Anthropic, Google, Mistral, ...) in the dashboard under Core > Projects and keys (/app/core/projects), in the provider keys section. ORYVOX then sends eligible requests through your provider account.

How BYOK requests are routed and billed

• For a provider where you added a key, ORYVOX calls that provider with your key instead of ORYVOX-managed capacity. Providers without your key keep using managed capacity (when your plan includes it), so routing and fallbacks still have the full model catalogue.
• To keep traffic on your own accounts only, allow just those providers in the project policy.
• The provider bills you directly for tokens sent with your key. ORYVOX adds no percentage: your Core plan (Free, Pro or Business) is the price. The request log marks these requests as BYOK (Billing).
• If the provider rejects your key, the attempt fails with auth and ORYVOX falls back to another route; if none succeeds the request fails with 502.
• Routing, caching, optimisation, budgets, policies and the request log work exactly the same.

Security

• Provider keys are encrypted at rest and never returned by the API or shown again in full.
• Only team owners and admins can add, rotate or remove provider keys.
• Removing a key takes effect immediately; in-flight requests finish.

Tips

• Use BYOK for providers where you have negotiated pricing, credits or data agreements (for example zero data retention).
• Combine with the project policy (allowed providers, regions) to keep certain traffic on your own accounts only.