Bring your own key

Route on your own provider contracts and pay us nothing on that traffic.

5 min read

What it does

Add your own OpenAI, Anthropic, Groq, DeepInfra or Together key and traffic routed through it costs you nothing here. Your provider bills you directly, at your own negotiated rates and against your own committed spend, and Multigrid still routes, retries, meters and logs the call — we simply do not bill for tokens you already pay someone else for.

There is no fee on that traffic at all. Our percentage is charged when you top up credit, and requests do not touch credit.

Adding a key

Paste it under Provider keys. Before it is stored we prove it works by listing models with it — every provider exposes that, it costs nothing, and it fails distinguishably on a bad key (401) versus a provider having a bad day (5xx). Saving an unverified key means finding out it was wrong through a failed production request instead of here.

Which key pays

Yours, wherever both exist. A route we could serve with our platform key and with yours goes to yours, even when the platform route has the better priority. You went to the trouble of pasting a key in order to stop paying us for those tokens; billing you anyway would be indefensible.

BYOK works at a zero balance

The balance pre-flight only prices routes we would actually charge for. An account with no credit and its own OpenAI key is still an account we can serve — failing the check drops the paid routes, not the request.

:free on a model id accepts exactly two kinds of route: one of your own keys, or a route genuinely priced at zero. It never falls back to a paid one.

Keys are read fresh on every request rather than cached. Revoke a leaked key and the next request stops using it — a sixty-second window where we keep spending your money is not worth saving one indexed lookup.

Seeing that it worked

Signal	Description
X-Multigrid-Byok	Present and `true` on any response your own key paid for.
multigrid.byok	The same fact on the response body.
multigrid.waived	`"byok"`. A zero cost is always given a reason.
multigrid.saved_usd	What the request would have cost on our credit.
byok_requests	On `GET /usage`, alongside the total you saved over the period.

How the key is stored

Encrypted with AES-256-GCM before it is written, and never returned to a client — not to the dashboard, not through the API. It is decrypted in memory for the duration of the upstream call and nowhere else: never logged, never serialised into a response, never written back in the clear.

If a key cannot be decrypted it is skipped

Which in practice means the deployment’s encryption key was rotated or lost. Skipping falls back to the platform key — a working request you pay for, rather than a hard failure — and the Provider keys page surfaces the same condition so you can re-enter it.

Something here disagrees with what the API actually did? That is a bug in this page, and worth reporting.

Report it