Bring your own keys
Your provider keys, our gateway - live today
Some gateways list BYOK as coming soon. Ours ships: add your own provider keys and requests on them are billed by the provider at your own rates, while routing, fallback, guardrails and observability keep working exactly as before.
- Requests on your keys are billed by the provider, not your Final Router credits - negotiated rates and provider credits keep their value
- Keys are AES-256-GCM encrypted before they touch the database and are never returned to the browser - verified on add, revocable in a click
- The fee is a published number: the first $25,000 of list-price usage each month is free, then 5% of list price - no sales call to learn it
What is BYOK?
BYOK - bring your own key - means the gateway calls providers with your API keys instead of its own. The provider bills your account directly, so negotiated rates, committed-use discounts and existing provider credits all keep working, while the gateway still supplies what your keys alone cannot: one endpoint, routing, fallback, caps, guardrails and a single log.
The defining questions are custody and price. Custody: your key is a credential that can spend money, so it is encrypted before storage, never displayed again, and revocable instantly. Price: a BYOK fee that is published on the pricing page is a cost you can budget; one that lives in a sales deck is not.
What you keep, what you gain
BYOK is not a downgrade path - every gateway feature keeps working on your keys.
Provider billing, your rates
Usage on your key lands on your provider invoice at whatever rate you negotiated. Final Router charges only the BYOK fee - and reports which key answered on every response.
final_router.used_own_key: true on every such response
Custody you can audit
Keys are verified against the provider when added, AES-256-GCM encrypted before Postgres, never sent back to any browser, and deleted the moment you revoke them.
verify on add · encrypt at rest · revoke in one click
Routing and fallback still apply
A chain can mix your keys and housed ones: your OpenAI key answers first, and if OpenAI is down the request falls back to a housed Anthropic model rather than failing.
per-provider: your key is used wherever you added one
One log either way
BYOK requests appear in the same log and analytics with the same cost accounting at list price - so the spend picture stays whole even when the money flows to two invoices.
caps and budgets count BYOK usage at list price
BYOK here vs BYOK elsewhere
| Final Router | Typical gateway | |
|---|---|---|
| Availability | Shipped and live | 'Coming soon' on the pricing page |
| Fee | Published: $25k/month free, then 5% of list price | Ask sales |
| Key custody | AES-256-GCM at rest, never returned to the browser | Varies, rarely stated |
| Feature parity | Routing, fallback, caps, guardrails all apply | Often a separate, thinner path |
| Attribution | used_own_key on every response | Reconciled from two invoices by hand |
FAQ
Which providers can I bring keys for?
Any of the eight behind the gateway - OpenAI, Anthropic, Google, Meta, Mistral, DeepSeek, Moonshot and xAI. Add keys for some providers and not others: each request uses your key where one exists and housed keys elsewhere.
How is my key stored, exactly?
It is verified against the provider when you add it, encrypted with AES-256-GCM before it is written to the database, and never returned to any browser afterwards - the dashboard shows only that a key exists. Revoking deletes it immediately.
What does BYOK cost?
The first $25,000 of list-price usage each month carries no fee at all. Above that, the fee is 5% of what the usage would have cost at list price. Both numbers are on the pricing page, not in a sales deck.
Do my caps and budgets still apply on my own keys?
Yes. Budgets and per-key caps count BYOK usage at list price, so a runaway loop on your own key is still stopped by your own ceilings - the provider billing the tokens doesn't change who enforces the limits.
Why use a gateway at all if I already have provider keys?
Because keys are not the hard part. One endpoint instead of N integrations, fallback when a provider fails, caps before the invoice, guardrails in the request path and one log across providers - that is what your keys alone don't do, and it all keeps working when the keys are yours.
Keep your rates. Gain the gateway.
Add a provider key in the dashboard, send one request, and read used_own_key: true on the response.
Related: the AI gateway, automatic fallback, AI spend management, pricing.