Bring your own keys — every provider behind one API

Bring Your Own Key (BYOK) lets you attach your own upstream provider keys — OpenAI, Anthropic, Google, and dozens more — to your AnyRouter account. When a request matches a model one of your keys can serve, AnyRouter forwards the call on your key. You keep every AnyRouter feature — one unified API, logs, analytics, presets, routing, app attribution — and pay the provider directly at their list price.

If you already hold provider accounts with credits, negotiated rates, preview access, or a flat-rate coding subscription, BYOK is the simplest way to put all of them behind a single OpenAI- and Anthropic-compatible endpoint. Point your existing client at the AnyRouter base URL, keep your model ids, and your own keys do the work.

BYOK turns a pile of separate provider accounts into one resilient endpoint:

• No markup on your own keys. AnyRouter charges nothing for BYOK traffic — no per-request fee, no surcharge, no minimum. You only ever pay your provider.
• Keep your own rate limits. You route on your account's quota, not a shared pool — so your limits are exactly what your provider gives you.
• Automatic failover. Add more than one key per provider and AnyRouter spreads traffic across them, quarantining a key that returns 401 or 429 and moving to the next — a single burned key stops being a single point of failure.
• Load-balancing strategies. Choose Fallback (priority order), Round Robin, Weighted, or Random for each provider's key pool.
• Falls back to credits. If every BYOK key for a provider is exhausted, requests can fall through to pay-as-you-go credits — so work keeps flowing.

AnyRouter exposes BYOK for more than 60 providers. A few of the most common, with the key format each expects:

Enterprise endpoints like Azure OpenAI, Amazon Bedrock, and Vertex AI accept structured credentials — the dialog shows the expected format when you pick the provider. The full provider-by-provider setup guide, including where to generate each key, lives at /docs/features/byok-providers.

Adding a key is a paste-and-save flow on the BYOK page:

1. Open the BYOK page at /byok (or Dashboard → BYOK) and click Add key on the provider you want.
2. Paste your provider API key. The value is write-only — once saved, AnyRouter never displays it again.
3. Optionally give it an alias, set a priority and weight for load balancing, or scope it to specific AnyRouter keys.
4. Click Save. AnyRouter runs one live validation call against the provider; if the key is rejected, the error is surfaced and nothing is stored.

Once you've added one or more keys, three built-in model ids route across all of them without naming a specific model — AnyRouter picks the strongest available model and falls back through the rest if a provider is busy:

Use them anywhere you'd use a normal model id. Add a key for a new provider and its models join the pool automatically — no config change:

curl https://anyrouter.dev/api/v1/chat/completions \
  -H "Authorization: Bearer $ANYROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "anyrouter/coding",
    "messages": [{ "role": "user", "content": "Refactor this function" }]
  }'

Because these only ever use your own keys, they never spend AnyRouter credits. Call one with no matching key and you get a clear error telling you to add a key — never a silent charge to paid capacity.

Most provider quota sits idle most of the time. The donate-to-pool program lets you put that idle capacity to work: flip a single toggle on an eligible BYOK key, and every request AnyRouter routes through it returns 5% of the request's token cost to your AnyRouter balance as credits.

• Earn 5% back. Each token served through your donated key credits 5% of its notional cost to your balance.
• ToS-safe only. Donation activates only for providers whose Terms of Service explicitly permit a third party to use your key. If a provider is silent or prohibits it, it stays excluded.
• Explicit consent. Donating requires a one-time, recorded acknowledgement that your key may serve other users' requests — nothing happens automatically.
• Opt out instantly. Toggle off in the dashboard and your key leaves the pool immediately, with no pending requests.

The reward program is rolling out: the pool opens for the first provider that grants explicit, documented permission for third-party key usage. You can add a key now and be ready to donate the moment it opens — see the details at /pool.

BYOK keys are sensitive credentials, and AnyRouter treats them that way:

• Encrypted at rest with a per-row salt — a leak of one key's ciphertext never weakens any other.
• Write-only in the UI — after save, only the alias and a masked identifier are shown; the full value can't be retrieved.
• Never logged — provider keys are stripped from request and response logs, keeping only the alias and provider so you can tell which credential served a request.
• Validated live on save, then the validation response is discarded.
• No third-party sharing — your key is only ever sent to the upstream provider it's scoped to.

Open /byok to connect your first provider key, then point any OpenAI- or Anthropic-compatible client at https://anyrouter.dev/api/v1 and start routing on your own accounts at no extra cost.

For the full feature reference, see /docs/features/byok. For step-by-step instructions on generating a key from each provider, see /docs/features/byok-providers.