Default WorkspaceGuides
429 fallback, coding agents & gateway comparisons
API DocsBYOK & Keys

BYOK AI Explained: What Bring Your Own Key Means, OpenRouter BYOK and BYOK Gateways

Updated · By Hisham · Published · Facts and limits are dated; check the linked sources.

When an application talks to more than one LLM provider, you have three ways to put a single OpenAI-compatible API in front of them: buy credits from a token reseller, run a self-hosted proxy on your own servers, or use a hosted Bring-Your-Own-Key (BYOK) gateway. This guide explains what a BYOK LLM gateway does, where it saves money or operational work, and when one of the other two models is a better fit. We build SentioGate, a hosted BYOK router, so we note our own limits clearly below.

As of 2026-10-26; the BYOK meaning and OpenRouter BYOK sections were checked 2026-11-03. Competitor pricing and features referenced below link to their public documentation.

What BYOK means for AI APIs

BYOK stands for bring your own key. In AI tools, it means you paste API keys from your own provider accounts (OpenAI, Anthropic, Google Gemini, Groq and so on) into a third-party app, router or gateway. The tool then calls the model with your key instead of its own shared key or prepaid credits. In practice:

  • The provider bills you directly, at its own prices, on your own account.
  • Your account's rate limits and data terms apply, not the tool's.
  • The tool charges for its own service, if anything: a flat plan, a small fee on BYOK usage, or nothing per token.

BYOK is a common pattern, not something one vendor invented. OpenRouter, Requesty, Portkey, LiteLLM and SentioGate all support it, as do many chat apps and coding tools. The questions that matter are what the tool charges on BYOK traffic and what it does when your key hits a limit.

Three ways to unify LLM providers

ModelHow billing worksWho runs the proxyBest when
Credit aggregator (e.g. OpenRouter)You prepay credits (5.5% Standard / 8% Business credit fee) or use BYOK (free up to $25k/mo list-price inference, 5% after)The vendorYou want one invoice and instant access to hundreds of models without opening provider accounts
Self-hosted proxy (e.g. LiteLLM, Bifrost)Providers bill you directly on your keysYou run Docker/Kubernetes, the database and upgradesYou need the gateway inside your own VPC or need custom plugins
Hosted BYOK router (e.g. SentioGate)Providers bill you directly at 0% token markup; flat gateway planThe vendorYou have direct provider keys or credits and want automatic routing and failover without running a server

OpenRouter BYOK vs a BYOK gateway

OpenRouter is best known for credits, but it also supports BYOK. According to its BYOK docs:

  • You add provider keys in your workspace BYOK settings, and they are stored encrypted.
  • BYOK usage costs 5% of what the same model and provider would normally cost on OpenRouter, deducted from your OpenRouter credits, after a plan-dependent monthly free allowance measured by list-price inference cost.
  • Keys are either Prioritized (tried before OpenRouter's own endpoints) or Fallback (tried after them).
  • By default, if all your keys hit a rate limit or fail, OpenRouter falls back to its shared endpoints, which spends OpenRouter credits. You can turn that off per key.

A BYOK gateway such as SentioGate takes a different approach. Once you add your keys, requests run only on them, at 0% token markup, and the free community pool is switched off for your account. When a key is rate-limited, SentioGate tries your next key for that provider and then, with model: "auto", automatically falls back to another model if one fails. An OpenRouter key works as one of those keys too, so you can use both. If you want OpenRouter's shared capacity as the safety net, OpenRouter BYOK covers it. If you want spending to stay on your own provider accounts, a BYOK gateway fits better.

What happens on a BYOK request

With SentioGate, your provider API keys (OpenAI, Gemini, Groq, Mistral, DeepSeek, xAI, or OpenRouter) live in a Vault, encrypted at rest. You enable the specific models your application trusts.

  1. One request format. Your app sends a standard OpenAI /v1/chat/completions call with model: "auto" (or a pinned provider/model).
  2. Health and cooldown check. Models that recently returned HTTP 429 or 5xx are held in a shared cooldown window that honors the provider's Retry-After header.
  3. Cost- and latency-aware ranking. Among your enabled, healthy models, auto ranks candidates for the request.
  4. Key failover, then model failover. If Key A on a provider hits a rate limit, the router tries Key B for that provider first, then moves to the next ranked model in your pool.
  5. Direct provider billing. The upstream provider bills your account directly. SentioGate adds 0% per-token markup.
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.sentiogate.dev/v1",
    api_key=os.environ["SENTIOGATE_API_KEY"],
)

resp = client.chat.completions.create(
    model="auto",
    messages=[{"role": "user", "content": "Extract the invoice total as JSON."}],
)
print(resp.choices[0].message.content)

Key management and spend controls

Because a BYOK gateway uses your own provider accounts, key hygiene matters:

  • Multiple keys per provider. In SentioGate's Vault you can store up to 5 keys per provider in priority order, with optional per-key spend and balance limits that pause a key.
  • Scoped model allowlists. model: "auto" never picks a model you haven't enabled in your Vault.
  • Per-request visibility. Responses include router metadata showing which policy ran, why a model was chosen, and any fallback attempts.

When a BYOK gateway is the wrong choice

  • You want a single consolidated bill across dozens of model providers instead of managing separate provider accounts: use OpenRouter.
  • You must self-host inside a private network or need an MCP gateway today: use LiteLLM or Bifrost (see our gateway comparison).
  • You need deep prompt tracing and evals: see our Helicone alternative guide.

You can test SentioGate before adding keys using its free community pool (a shared community evaluation tier capped at 600 requests per 5 hours per user during beta), then add your own keys in the Vault for production. See the API docs and pricing.

FAQ

What is a BYOK LLM gateway?

A gateway that routes requests with your own provider API keys. The provider bills your account directly, and the gateway handles one request format, key failover and model failover.

Is BYOK unique to SentioGate?

No. Bring your own key is a common pattern: OpenRouter, Requesty, Portkey and LiteLLM support your own provider keys, as do many chat and coding tools. The differences are what each charges on BYOK traffic and what happens when your key hits a limit.

How does OpenRouter BYOK work?

You add provider keys in OpenRouter's BYOK settings. Usage costs 5% of the normal OpenRouter price for that model and provider, deducted from your credits, after a plan-dependent monthly free allowance. By default, if all your keys fail or are rate-limited, OpenRouter falls back to its shared endpoints; you can turn that off per key.

Does SentioGate add a markup on BYOK requests?

No. With your own keys the upstream provider bills you directly, and SentioGate adds 0% per-token markup.

How many keys can I add per provider?

Up to 5 keys per provider in SentioGate's Vault, in priority order, with optional per-key spend and balance limits that pause a key.

When is a BYOK gateway the wrong choice?

When you want one consolidated bill instead of separate provider accounts, when you must self-host inside a private network or need an MCP gateway today, or when you need deep prompt tracing and evals.

Sources

All accessed 2026-10-26.