BYOK — bring your own keys

BYOK lets you use your own provider accounts through BharatRouter: one API, one SDK, our routing and failover — your key and your billing upstream. It unlocks every provider you bring a key for (Krutrim Cloud, Sarvam, Mistral, DeepSeek, OpenAI, Groq, Together, Fireworks, Cerebras, xAI and more — 50 providers in all), and runs each request on your own negotiated rates.

Want to route to a model running on a deployment you host, not a provider we support? That's BYOE — bring your own endpoint; seeBYOE vs BYOK for which to use.

BYOK requests are free during beta — BharatRouter charges nothing on top; your provider bills you directly.

Two ways to BYOK

1. Per-request: upstream_key

Pass your provider key on a single request. It is used in-flight, never stored, never logged. Combine with provider to pin where it goes:

curl https://api.bharatrouter.com/v1/chat/completions \
  -H "Authorization: Bearer br-..." -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-oss-20b",
    "provider": "groq",
    "upstream_key": "YOUR_GROQ_KEY",
    "messages": [{"role": "user", "content": "namaste"}]
  }'

2. Saved org keys (recommended)

Save a key once — on the dashboard's BYOK tab or viaPUT /me/byok/:provider (org owner) — and every request from your org can use it without the key ever appearing in application code:

PUT /me/byok/krutrim
{ "key": "YOUR_KRUTRIM_CLOUD_KEY", "label": "prod", "always_use": false }

→ { "provider": "krutrim", "mask": "krtm-…a9f2", "always_use": false,
    "verified": true, "models_discovered": 14 }

On save the key is verified live against the provider and encrypted at rest (AES-256-GCM); the plaintext is never returned — only a mask. Re-check a saved key any time with POST /me/byok/:provider/test, remove it withDELETE /me/byok/:provider.

Model discovery

When you save a key, the gateway asks that provider for its model list withyour key and makes everything it finds routable asprovider/model-id:

GET /me/byok/mistral/models
→ { "provider": "mistral", "models": ["mistral/mistral-large-latest", "mistral/codestral-latest", ...] }

# then simply:
client.chat.completions.create(model="mistral/mistral-large-latest", messages=[...])

Discovery refreshes on key save and on test; a flaky provider listing doesn't wipe previously discovered models.

Key precedence

BYOK is required: every route runs on your own provider key, and there is no platform key to fall back to. If your key fails, the request fails — surfaced as a key error, so you know which key broke.

1. A per-request upstream_key always wins — used for that call only, never stored.
2. Otherwise, the org's saved key for the selected provider is used.
3. If no key is available for the provider, the request fails — there is no platform fallback.

BYOK key failures are attributed to the key, not the provider route — your expired key won't trip the shared circuit breaker.

Who can use a key (custody vs use)

A saved key is owned by your org, but it carries two independent rights, so you can share the account without handing out the secret:

• Custody — see, rotate or revoke the key. Held by org owners & admins.
• Use — route calls through the key. The secret is never exposed to the people who can use it.

Use is granted along one flat ladder — there is no workspace nesting:

Set the tier per key in the Key Vault (owners only), or via the API:

PUT /me/byok/<provider>/grants
{ "use": [ { "scope_kind": "workspace", "scope_id": 42 } ] }

# empty list  = org-wide (everyone, the default)
GET /me/byok/<provider>/grants   # { use: [...], custody: [...] }

Because scope — not a parent/child tree — decides sharing, one key can serve any set of teams and workspaces without duplication, and workspaces stay flat and easy to reason about.

Which providers accept BYOK?

GET /me/byok returns the live list of providers you can bring a key for. Every provider below is BYOK — save your key and its models become routable.

🇮🇳 Krutrim Cloud🇮🇳 Sarvam AIOpenAIOpenRouterGroqMistral AIDeepSeekTogether AIFireworks AICerebrasxAIMoonshot AIDeepInfraNovita AISambaNovaNebius AI StudioHyperbolicNVIDIA NIMPerplexityAI21 LabsUpstageMiniMaxAlibaba Qwen (Intl)Z.ai (Zhipu)Featherlesskluster.aiLambdaChutesCohereGoogle GeminiAI/ML APIFriendliAIInception (Mercury)Jina AIOVHcloud AI EndpointsVenice AISiliconFlowBasetenNscaleMeta Llama APIStepFunGMI CloudScalewayDigitalOcean GradientVolcano Engine (ByteDance)Baidu ERNIEParasailW&B InferenceElevenLabsGitHub Models

Full details per provider — residency, live catalog routes — on theproviders page.

BYOK errors