Provider Keys

Let customers bring their own AI provider credentials (BYOK). When set, the gateway uses customer credentials instead of platform providers — no balance deduction, costs tracked per API key budget.

Auth: Session token (JWT) or platform key with X-Workspace-Id header.

List Provider Key Status

GET /v1/platform/provider-keys

Returns which providers have customer-supplied credentials.

const providers = await billing.providerKeys.list()

Response

{
  "data": [
    {
      "providerId": "openai",
      "name": "OpenAI",
      "hasKey": true,
      "env": ["OPENAI_API_KEY"]
    },
    {
      "providerId": "anthropic",
      "name": "Anthropic",
      "hasKey": false,
      "env": ["ANTHROPIC_API_KEY"]
    }
  ]
}

Field	Type	Required	Description
`providerId`	string	Always	Provider identifier
`name`	string	Always	Human-readable provider name
`hasKey`	boolean	Always	Whether the workspace has set credentials
`env`	string[]	Always	Environment variable names for the provider

Set Provider Credentials

PUT /v1/platform/provider-keys/:providerId

Store or update credentials for a provider. Credentials are encrypted at rest (AES-256-GCM).

Path Parameters

Param	Type	Required	Description
`providerId`	string	Yes	Provider identifier (e.g. `openai`, `anthropic`)

Body Parameters

Name	Type	Required	Description
`credentials`	object	Yes	Provider-specific keys (e.g. `{ "api_key": "sk-..." }`)

await billing.providerKeys.set('openai', { api_key: 'sk-proj-...' })

Response

{
  "success": true
}

Test Provider Credentials

POST /v1/platform/provider-keys/:providerId/test

Validate stored credentials by making a test API call to the provider.

Path Parameters

Param	Type	Required	Description
`providerId`	string	Yes	Provider identifier

const result = await billing.providerKeys.test('openai')

Response (success)

{
  "valid": true
}

Response (failure)

{
  "valid": false,
  "error": "Invalid API key"
}

Remove Provider Credentials

DELETE /v1/platform/provider-keys/:providerId

Delete stored credentials. Gateway falls back to platform providers.

Path Parameters

Param	Type	Required	Description
`providerId`	string	Yes	Provider identifier

await billing.providerKeys.remove('openai')

Response

{
  "success": true
}