Your own provider keys

With your own provider key (often called BYOK), requests for that provider's models run on your account with the provider. The provider bills you directly; Safeguard charges nothing for those requests and reserves no credit for them. Your Safeguard key, spend limits on paid requests, rate limits, routing and the request log work as before.

Add a key

1. In the Console, open API keys. Provider keys is below your keys. Only a tenant admin or super admin sees it.
2. Choose Set for a provider, paste the key and save.

After you save, the key is never shown again, to you or to anyone else: the Console shows only its last four characters. It is kept in Safeguard's vault as a sealed credential that no person, workspace member or Safeguard administrator can list or reveal; only the gateway reads it, when it calls the provider for your workspace. Replace overwrites it, and Delete removes it.

You can switch a key off without deleting it. While it is off, requests use Safeguard's access to that provider where it is offered.

How requests use it

When your workspace has an enabled key for a model's provider route, every request for that route, from an API key or the Workbench, runs on your key:

• the cost recorded for the request is $0, and no credit is reserved;
• the request log marks it as running on your key;
• the provider's own terms, limits and data handling under your account apply.

A model can run on your key even where it is not yet sold through Safeguard, as long as it is published in the catalog.

If the provider refuses your key (it is wrong, revoked or lacks access), the request fails with 502 upstream_auth and the message "Your provider key was refused by the provider." The gateway never falls back to Safeguard's own access in that case, so a request you meant to pay for directly is never charged to your credit. If the key cannot be read, the request fails with 503.

Related

• Privacy and data
• Pricing and billing
• Errors