Bring Your Own API Keys (BYOK)

Bring Your Own Key (BYOK) lets you connect your own provider API keys to the G8KEPR AI Gateway, so requests run on your provider accounts and billing. Keys are encrypted at rest and can be scoped to a single user, a team, or your whole organization, each with its own spend limits.

How BYOK works

When you add a provider key, G8KEPR stores it encrypted and never returns the raw value again. The gateway decrypts it only in memory to authenticate outbound requests. You choose a scope that decides who can use the key and a cost limit that caps spend before requests are rejected.

Add a provider key

1. 1.Go to AI Gateway → Provider Keys and select Add key.
2. 2.Choose a provider (for example OpenAI or Anthropic).
3. 3.Paste your API key and give it a recognizable label.
4. 4.Set the scope: User, Team, or Organization.
5. 5.Optionally set a monthly cost limit in USD.
6. 6.Select Save. The key is encrypted immediately and masked in the UI.

You can also manage keys through the API:

curl -X POST https://app.g8kepr.com/api/v1/gateway/keys \
  -H "Authorization: Bearer $G8KEPR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "openai",
    "label": "Marketing team key",
    "api_key": "sk-...",
    "scope": "team",
    "scope_id": "team_123",
    "monthly_limit_usd": 500
  }'

Set and monitor cost limits

Cost limits stop runaway spend. When a scope reaches its limit, the gateway returns an error instead of forwarding the request, until the next monthly reset or a limit increase.

• ▸Per-user limits keep individual experimentation in check.
• ▸Per-team limits let you budget by department.
• ▸Org limits act as a global ceiling across all keys.

Rotate or revoke

Delete a key at any time from the same Provider Keys page. Revocation takes effect immediately, and any request that would have used it fails fast.

See also Routing requests through the AI Gateway and Understanding gateway cost controls.