Bring your own keys - Tokenless

Bring your own keys (BYOK) lets you supply an upstream provider API key while keeping Tokenless routing. When an active, enabled key exists for a provider, Tokenless uses that key for that provider’s upstream legs. When no key exists, Tokenless uses the platform-managed key.

BYOK management requires an interactive dashboard or tkl CLI session. A regular Tokenless API key cannot create, view, or revoke provider keys.

Supported providers

openai
anthropic
deepseek

Keys are validated against the provider before they are stored. Tokenless stores only encrypted key material; list responses contain provider metadata and the last four characters, never the key itself.

Routing behavior

An enabled BYOK key is used only for matching upstream provider legs. If a provider rejects an enabled key after it is stored, Tokenless returns an error that identifies the provider rather than silently falling back to the platform key.

⌘I