Provider Keys

The Provider Keys page lets you add your own API keys from LLM providers (OpenAI, Anthropic, Google, etc.) to route requests directly through your accounts without additional gateway fees. The only optional charge is data storage: if your organization enables full data retention, stored requests are billed at $0.01 per 1M tokens from your credits.

Adding a Provider Key

Click Add Provider Key to configure a new key:

• Provider — Select which provider this key belongs to
• Custom name — An optional label to identify the key
• API key — Your provider's API key
• Base URL — Optional custom endpoint for custom deployments (Enterprise plan)
• Allowed models — Optional allowlist restricting which models the key serves
• Max spend — Optional USD cap; the key is disabled once the spend attributed to it reaches the limit

Provider Keys List

Each configured key shows:

Actions

For each provider key:

• Edit description — Change the key's display label
• Rename — Custom providers only: change the provider name, and with it the <name>/<model> prefix clients use
• Restrict models — Choose which models the key may serve
• Set limits — Cap the spend attributed to the key and its rate limits
• Deactivate — Temporarily disable the key without deleting it
• Delete — Permanently remove the key

A key's secret and base URL cannot be edited — delete the key and add it again to change them. Custom provider tokens and base URLs can also be rotated through the master API.

Rate Limits

Each key can cap its own requests per minute or day (RPM/RPD) and prompt + completion tokens per minute or day (TPM/TPD), for example to match the quota of the upstream account. While a key is at any of its caps it is skipped: the next key for the provider serves the request, routing prefers other providers, and in hybrid mode the request falls back to LLM Gateway credits. If every key for the requested provider is capped and nothing else can serve the request, the gateway returns 429 with a Retry-After header.

Requests and tokens are counted once a request completes, so requests already in flight and the request that crosses a cap still finish. Leave a field empty for no limit.

The limit mode decides which requests a capped key still serves, with the same meaning as provider rate limits:

• Strict (default) — the key is skipped for every request.
• Soft — a session already pinned to the key's provider keeps using the key, so multi-turn conversations, including encrypted reasoning on OpenAI and Azure, keep working. New sessions and requests without a session use other keys or providers.
• Lax — like soft, and requests that name the provider explicitly (provider/model) may also use the key. Automatic routing and fallback from another provider still skip it.

Exempt requests still count toward the key's caps. A conversation that replays encrypted reasoning issued by a key always keeps that key, whatever its mode, because no other key can verify the replay.

Restricting a Key to Specific Models

Provider accounts often only have some of a provider's models enabled. Set Allowed models on a key to list exactly the models it may serve — routing then skips that key for anything else instead of sending a request the upstream account will reject. Leave the list empty to serve every model the provider offers.

The restriction also decides how a key is checked when you save it: a restricted key is validated against one of its own allowed models rather than the provider's default validation model, so a key with partial model access still validates.