BYOK Provider Setup Guide
Bring your own API keys for every supported upstream provider — pick a provider for step-by-step key setup, then add it under Dashboard → BYOK.
Every BYOK provider hides its API-key page in a slightly different corner of its console, and each key has its own prefix and format. Pick a provider below for exact, step-by-step instructions on where to generate the key and how to add it to AnyRouter.
The general flow
Adding any key follows the same three steps — generate, paste, save:
Open the provider's API-key page (linked on each provider page), create a new key, and copy it. Many providers show the secret only once, so copy it immediately.
Go to Dashboard → BYOK, find the provider under Available, and click Add key. Paste the key into the API key field.
Click Save. AnyRouter runs a live validation call against the provider before storing the key. If validation fails, the dialog surfaces the upstream error and the key isn't saved.
The dashboard lives at anyrouter.dev/dashboard, and the old dash.anyrouter.dev address leads there too.
What the API reports about each key
Adding a key from the dashboard is the easy path. If you add keys from a script instead, the API tells you two extra things about every key it returns:
| Field | Values | What it means |
|---|---|---|
kind | byok or donated | donated while the key is shared with the community shared pool — including while a donated key is temporarily paused. byok means it serves only your own requests. Donating and withdrawing are what change it. |
source | cli, dashboard, or api | Which app added the key: the command-line tool, the dashboard, or your own script. |
Pass source when you add a key so you can tell one script's keys from another's later:
curl -X POST https://anyrouter.dev/api/v1/auth/byok \
-H "Authorization: Bearer ak_live_..." \
-H "Content-Type: application/json" \
-d '{
"provider_id": "openai",
"api_key": "sk-proj-…",
"label": "laptop",
"source": "cli"
}'source accepts cli, dashboard, or api — anything else is rejected with 400. Leave it out and it defaults to api, which is also what keys added before this field existed report. The dashboard sets dashboard for keys you add there. The installed anyr binary doesn't set cli yet, so keys it adds report api until a new release ships — set it yourself when your own script adds a key.
The response (and every later GET /api/v1/auth/byok) carries both fields:
{
"id": "byok_01JQZ…",
"provider_id": "openai",
"label": "laptop",
"key_preview": "sk-p****7c2",
"enabled": true,
"route_coverage": "all",
"kind": "byok",
"source": "cli"
}key_preview is a masked copy of the key — the first four characters, ****, and the last three. The key itself is never returned. Keys are listed per workspace, so a key added under one organization doesn't appear under another.
Providers
Choose your provider for detailed setup steps:
Related
- Bring Your Own Key (BYOK) — routing precedence, load balancing, security, and costs
- Free-tier aggregation — combine free tiers from these providers behind one preset
- Smart Routing — how AnyRouter picks an upstream per request