Bring Your Own Key (BYOK)

Use your existing provider API keys with Tangle Inference. BYOK requests have zero platform markup: you pay the provider’s list price directly.

Per-request BYOK

Pass credentials in providerOptions.gateway.byok:

{
  "model": "anthropic/claude-sonnet-4-6",
  "messages": [{"role": "user", "content": "Hello"}],
  "providerOptions": {
    "gateway": {
      "byok": {
        "anthropic": [{"apiKey": "sk-ant-your-key"}]
      }
    }
  }
}

Multiple credentials

The array shape is accepted for Vercel AI Gateway compatibility, but only the first credential is used. If it fails, the gateway falls back to platform credentials (compliance filters preserved), not to a second BYOK key.

Multiple providers

{
  "providerOptions": {
    "gateway": {
      "byok": {
        "anthropic": [{"apiKey": "sk-ant-..."}],
        "openai": [{"apiKey": "sk-..."}]
      }
    }
  }
}

Automatic fallback

If your BYOK credentials fail (401, 403, rate limit), the gateway automatically falls back to platform credentials. This fallback preserves all compliance filters - if you requested ZDR, the fallback will only use ZDR-compliant system credentials.

The X-Tangle-BYOK response header indicates whether the request used your credentials:

X-Tangle-BYOK: true    # Your key was used

If the header is absent, platform credentials were used (possibly via fallback).

Pricing

Security

• BYOK credentials are never logged or stored.
• Credentials exist only in memory for the duration of the request.
• The providerOptions field is stripped from the request body before forwarding to providers.
• Credentials are validated by structure (apiKey must be a string) and sanitized against prototype pollution.