What is BYOK (bring your own key)?

BYOK — bring your own key — describes an arrangement where a product performs work using a credential you hold with a third party, rather than one the vendor holds and resells to you. In AI it almost always means model provider keys: you keep your accounts with OpenAI, Anthropic or Google, and the product sends requests with your key.

The phrase is also used for encryption keys, which is a different thing with the same name. Worth checking which one a vendor means.

The three things vendors call BYOK

1. You own the provider account. Inference appears on your own OpenAI or Anthropic bill at list price. The product charges for what it does, not for tokens.

2. The vendor resells with a markup. You have no provider account; the vendor buys capacity and bills you for it, usually at a percentage over cost or a per-million-token rate. Convenient, and the opposite of BYOK despite sometimes being marketed near it.

3. You bring a key, the vendor still meters it. You supply the credential and pay the product per token that passes through. This exists, and is worth spotting.

Only the first gives you the properties people want from BYOK.

What it actually changes

Price transparency. You see provider pricing directly, including the discounts and committed-use terms you negotiated. A markup is invisible by construction — you cannot audit a bundled rate.

Rate limits and tier. Your limits are your account's, which means they grow with your own usage history rather than being shared with every other customer of the product.

Who the provider's data terms bind. This is the part that gets overlooked. With your own key, your contract with the model provider governs the request: your zero-retention terms, your region, your enterprise agreement. With a reseller, the provider's relationship is with the vendor, and you inherit whatever they negotiated. If you have gone to the trouble of a zero-retention agreement, routing requests through someone else's account discards it.

Portability. A product that cannot be separated from its inference billing is harder to leave. Keys you own are leverage: the switching cost is configuration, not a renegotiation.

Model choice. BYOK products tend to support whatever you have keys for, including models released last week, because they are not reselling a curated catalogue they have to price first.

What it costs you

Honesty requires the other column:

• You manage the accounts. Several providers, several billing relationships, several sets of limits to raise.
• No pooled capacity. A reseller's aggregate account can absorb a spike that your own tier would refuse.
• Spend control is yours. The provider will happily bill you for a runaway loop. This is why a BYOK product needs budgets of its own — token allowances per model and per team — or it has handed you the bill with no brake.
• Key handling becomes your diligence problem. You are giving a third party a credential that can spend money. How is it stored, who can read it, can it be scoped, and what happens to it when you cancel?

Questions worth asking

• Is inference billed by you or by the vendor? If the vendor, this is not BYOK.
• Are keys scoped per team, and revocable without rotating the provider key everywhere?
• Can a budget cap or redirect requests, or does overspend simply happen?
• Which wire formats are supported? Chat completions is table stakes; the Responses and Anthropic Messages shapes matter if you use the Codex CLI, Claude Code or the Anthropic SDKs.
• Does the product work if you don't bring a key — and what does it charge then?

Memtro is BYOK in the first sense: it routes each request across the provider keys you already hold, by difficulty, with the reason returned on every response, and charges one price per organisation by headcount rather than metering tokens. The brake is built in: token allowances per model choice, per organisation and per team, so a cheaper model answers when an allowance runs out instead of the bill continuing.