Skip to main content
Bring your own keys (BYOK) lets you supply an upstream provider API key while keeping Tokenless routing. When an active, enabled key exists for a provider, Tokenless uses that key for that provider’s upstream legs. When no key exists, Tokenless uses the platform-managed key.
BYOK management requires an interactive dashboard or tkl CLI session. A regular Tokenless API key cannot create, view, or revoke provider keys.

​
Supported providers

  • openai
  • anthropic
  • deepseek
Keys are validated against the provider before they are stored. Tokenless stores only encrypted key material; list responses contain provider metadata and the last four characters, never the key itself.

​
Routing behavior

An enabled BYOK key is used only for matching upstream provider legs. If a provider rejects an enabled key after it is stored, Tokenless returns an error that identifies the provider rather than silently falling back to the platform key.