# Add External Keys (BYOK)

### Overview

Adding external keys via FastRouter's Bring Your Own Key (BYOK) feature gives your organization the flexibility to ensure shared developer keys remain secure and protected. Leverage FastRouter's built-in rate limits, integrated dashboard, and robust governance tools to monitor usage, enforce access controls, and prevent unauthorized overuse—all while maintaining full control over your provider-specific billing and limits.

{% embed url="<https://youtu.be/UrkAPbQPqHc>" %}

### Who Can Use BYOK?

Only **Organization Owners** can currently:

* Add, update, or remove provider keys.
* Set provider-specific preferences and priorities.
* Enable routing through organization-supplied credentials.

This ensures security and administrative control over billing and usage.

> **Note:** When using BYOK, **rate limits and costs are determined by your own provider account**, not by FastRouter.

### Supported Providers

You can currently attach your provider keys for:

* Anthropic
* AWS Bedrock
* Azure
* Baseten
* DeepInfra
* Fal.AI
* Google AI Studio
* Google Vertex AI
* Grok
* Groq
* Moonshot AI
* OpenAI
* Perplexity
* Pollo.AI
* Mistral

### Special Provider Configuration Formats

**For Azure:**

You can pass an **array of configurations for multiple models** when using Azure BYOK.

```json
[
  {
    "model_slug": "openai/gpt-4o",
    "endpoint_url": "ENDPOINT-URL",
    "api_key": "API-KEY",
    "model_id": "gpt-4o"
  },
  {
    "model_slug": "openai/o3-mini",
    "endpoint_url": "ENDPOINT-URL",
    "api_key": "API-KEY",
    "model_id": "o3-mini"
  }
]
```

> Make sure the `model_slug` matches the FastRouter model name, and that `model_id` aligns with the model name configured in your Azure account.

***

**For AWS Bedrock:**

You can provide a **single configuration object** containing access credentials and the target AWS region.

```json
{
  "accessKeyId": "your-aws-access-key-id",
  "secretAccessKey": "your-aws-secret-access-key",
  "region": "your-aws-region"
}
```

> Ensure your credentials have the necessary permissions for invoking Bedrock models.