Add External Keys (BYOK)

FastRouter supports adding external keys or Bring Your Own Key (BYOK) functionality, allowing organizations to attach and manage their own API keys.

Overview

Adding external keys via FastRouter's Bring Your Own Key (BYOK) feature gives your organization the flexibility to ensure shared developer keys remain secure and protected. Leverage FastRouter's built-in rate limits, integrated dashboard, and robust governance tools to monitor usage, enforce access controls, and prevent unauthorized overuse—all while maintaining full control over your provider-specific billing and limits.

Who Can Use BYOK?

Only Organization Owners can currently:

• Add, update, or remove provider keys.

• Set provider-specific preferences and priorities.

• Enable routing through organization-supplied credentials.

This ensures security and administrative control over billing and usage.

Note: When using BYOK, rate limits and costs are determined by your own provider account, not by FastRouter.

Supported Providers

You can currently attach your provider keys for:

• Anthropic

• AWS Bedrock

• Azure

• Baseten

• DeepInfra

• Fal.AI

• Google AI Studio

• Google Vertex AI

• Grok

• Groq

• Moonshot AI

• OpenAI

• Perplexity

• Pollo.AI

• Mistral

Special Provider Configuration Formats

For Azure:

You can pass an array of configurations for multiple models when using Azure BYOK.

[
  {
    "model_slug": "openai/gpt-4o",
    "endpoint_url": "ENDPOINT-URL",
    "api_key": "API-KEY",
    "model_id": "gpt-4o"
  },
  {
    "model_slug": "openai/o3-mini",
    "endpoint_url": "ENDPOINT-URL",
    "api_key": "API-KEY",
    "model_id": "o3-mini"
  }
]

Make sure the model_slug matches the FastRouter model name, and that model_id aligns with the model name configured in your Azure account.

---

For AWS Bedrock:

You can provide a single configuration object containing access credentials and the target AWS region.

{
  "accessKeyId": "your-aws-access-key-id",
  "secretAccessKey": "your-aws-secret-access-key",
  "region": "your-aws-region"
}

Ensure your credentials have the necessary permissions for invoking Bedrock models.