Skip to main content
Instead of using AI Gateway API Keys with ngrok-managed provider keys, you can configure your own provider API keys directly in the gateway’s Traffic Policy. This is called Bring Your Own Keys (BYOK).
When you configure provider keys in the gateway, your endpoint becomes publicly accessible—anyone with the URL can make requests using your keys. You must add your own authorization layer. See Securing Endpoints (BYOK).

​
When to use BYOK

  • You already have provider accounts and billing relationships
  • You need specific provider plans or tiers (enterprise agreements, committed-use discounts)
  • You want to use providers beyond OpenAI and Anthropic (Google, DeepSeek, OpenRouter, etc.)
  • You want to use custom or self-hosted providers (Ollama, vLLM)—see Custom Providers
  • You need fine-grained control over which provider keys are used (CEL-based key selection)
  • You want to manage your own cost allocation per key

​
How BYOK works

  1. Store your provider API keys in ngrok Vaults & Secrets
  2. Reference them in your AI Gateway Traffic Policy
  3. The gateway uses your keys instead of ngrok’s managed keys
on_http_request:
  - type: ai-gateway
    config:
      providers:
        - id: openai
          api_keys:
            - value: ${secrets.get('openai', 'primary-key')}
            - value: ${secrets.get('openai', 'backup-key')}
        - id: google
          api_keys:
            - value: ${secrets.get('google', 'key')}

​
AI Gateway API Keys compared to BYOK

AI Gateway API KeysBYOK
Provider accounts neededNo (OpenAI & Anthropic only)Yes
Credits requiredYes (processing fee + upstream provider fee)No
Provider billingIncluded in credits (ngrok pays provider)Direct with providers
Setup complexityLow (create key, use it)Medium (configure secrets, Traffic Policy)
Key rotationManaged by ngrok (provider keys)You manage
Multi-key failoverAutomaticConfigurable
CEL key selectionNot applicableFull control
Custom/self-hosted providersNot supportedSupported
AuthBuilt-in (AI Gateway API Key)DIY (secrets, JWT, etc.)
Supported providersOpenAI, AnthropicAny provider

​
Mixed mode

You can combine both approaches in the same gateway. Use AI Gateway API Keys for OpenAI and Anthropic while bringing your own keys for other providers. When you authenticate with an AI Gateway API Key, BYOK keys take precedence for providers where they’re configured. See AI Gateway API Keys—Mixed mode for details.

​
Guides

Configuring Providers

Set up providers, models, and API keys in your Traffic Policy

Managing Provider Keys

Store, rotate, and manage your provider API keys

Key Selection & Failover

Advanced CEL-based key selection strategies

Securing Endpoints

Add authorization when using your own provider keys