Skip to main content

BYOK — bring your own keys

Enterprise workspaces can attach their own provider API keys. Calls still flow through the gateway — routing, failover, observability, audit — but upstream billing lands on your provider contract.

How it works​

  1. A workspace admin opens BYOK Providers in the console and adds a provider key (OpenAI, Anthropic, Google, …).
  2. The key is encrypted at rest (KMS) and verified with a test call before activation.
  3. Requests from your workspace that route to that provider use your key. Everything else about the request — the API surface, model ids, usage dashboards — stays identical.

What changes on the bill​

  • Gateway fee: metered per call/tokens as usual.
  • Provider cost: charged by the provider to your own account — it disappears from your ArkaFlow wallet spend.

Scoping and fallback​

  • Keys are workspace-scoped; projects inherit them.
  • If your key is rate-limited or fails verification mid-flight, behaviour follows your workspace's BYOK policy — strict (fail the call) or pooled fallback (route to platform keys) — configurable per provider entry.

Operational guardrails​

  • Rotate keys from the same page; the old key stops being used immediately.
  • Every BYOK change is written to the workspace audit log.
  • The platform never logs key material; verification errors surface with the provider's message, redacted of secrets.