The recommended way to use your own provider API keys is to attach them directly to your AI Gateway API Key. ngrok encrypts and stores them—no Traffic Policy configuration or Vaults & Secrets needed. See Attaching Provider Keys to get started.Documentation Index
Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
Use this file to discover all available pages before exploring further.
When Traffic Policy keys are still needed
Traffic Policyproviders[].api_keys configuration is still required for:
- Custom or self-hosted providers: any provider with a
base_url(Ollama, vLLM, custom endpoints). See Custom Providers.
Migrating from Traffic Policy keys
If you currently useproviders[].api_keys, see Migrate to Attached Provider Keys for step-by-step instructions.
Comparing your options
| AI Gateway API Keys | Attached provider keys | BYOK | |
|---|---|---|---|
| Provider accounts needed | No (OpenAI & Anthropic only) | Yes | Yes |
| Credits required | Yes | No | No |
| Provider billing | Included in credits (ngrok pays provider) | Direct with providers | Direct with providers |
| Setup complexity | Low (create key, use it) | Low (attach key to API key) | Medium (configure secrets, Traffic Policy) |
| Key storage | ngrok manages | Encrypted by ngrok | ngrok Vaults & Secrets |
| Key rotation | Managed by ngrok | Update attached key | Update secret or Traffic Policy |
| Multi-key failover | Automatic | Automatic (most recently attached key tried first) | Configurable (keys tried in list order) |
| Custom/self-hosted providers | Not supported | Not supported | Supported |
| Auth | Built-in (AI Gateway API Key) | Built-in (AI Gateway API Key) | DIY (secrets, JWT, etc.) |
| Supported providers | OpenAI, Anthropic | Any supported provider | Any provider |
Mixed mode
You can combine all three approaches in the same gateway. When you authenticate with an AI Gateway API Key, the per-provider lookup order is: attached provider keys → Traffic Policy BYOK → ngrok-managed keys. Attached keys fully replace BYOK for a provider; BYOK is only consulted when no key is attached for that provider. See Attaching Provider Keys and AI Gateway API Keys for details.Guides
Attaching Provider Keys
Attach your own provider keys to an AI Gateway API Key
Migrate to Attached Provider Keys
Move existing Traffic Policy keys to attached keys
Configuring Providers
Set up custom and self-hosted providers in Traffic Policy