Skip to main content
POST
Create a BYOK provider credential

Authorizations

Authorization
string
header
required

API key as bearer token in Authorization header

Body

application/json
key
string
required

The raw provider API key or credential. This value is encrypted at rest and never returned in API responses.

Minimum string length: 1
Example:

"sk-proj-abc123..."

provider
enum<string>
required

The upstream provider this credential authenticates against, as a lowercase slug (e.g. openai, anthropic, amazon-bedrock).

Available options:
ai21,
aion-labs,
akashml,
alibaba,
amazon-bedrock,
amazon-bedrock/claude-on-aws,
amazon-nova,
ambient,
anthropic,
anthropic/2,
arcee-ai,
assemblyai,
atlas-cloud,
avian,
azure,
baidu,
baseten,
black-forest-labs,
byteplus,
cerebras,
chutes,
cirrascale,
clarifai,
claude-on-aws,
cloudflare,
cohere,
coreweave,
cosine,
crusoe,
darkbloom,
databricks,
decart,
deepgram,
deepinfra,
deepseek,
dekallm,
digitalocean,
elevenlabs,
featherless,
fireworks,
fish-audio,
friendli,
gmicloud,
google-ai-studio,
google-vertex,
groq,
heygen,
inception,
inceptron,
inferact-vllm,
inference-net,
infermatic,
inflection,
io-net,
ionstream,
krea,
liquid,
makora,
mancer,
mara,
meta,
minimax,
mistral,
modal,
modelrun,
modular,
moonshotai,
morph,
near-ai,
nebius,
nex-agi,
nextbit,
novita,
nvidia,
ollama,
open-inference,
openai,
parasail,
perceptron,
perplexity,
phala,
poolside,
primeintellect,
quiver,
recraft,
reka,
relace,
respan,
runway,
sail-research,
sakana,
sakana-ai,
sambanova,
scaledown,
seed,
siliconflow,
sourceful,
stepfun,
streamlake,
switchpoint,
tencent,
tenstorrent,
thinkingmachines,
together,
typesafe,
unbiased,
upstage,
venice,
voyageai,
wafer,
wandb,
wandb-legacy,
xai,
xiaomi,
z-ai
Example:

"openai"

allowed_api_key_hashes
string[] | null

Optional allowlist of OpenRouter API key hashes (api_keys.hash) that may use this credential. null means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.

Required array length: 1 - 100 elements
Pattern: ^[a-f0-9]{64}$
Example:
allowed_models
string[] | null

Optional allowlist of model slugs this credential may be used for. null means no restriction.

Maximum array length: 100
Example:

null

allowed_user_ids
string[] | null

Optional allowlist of user IDs that may use this credential. null means no restriction.

Maximum array length: 100
Example:

null

declared_region
enum<string> | null

Your declaration of the data region in which the upstream provider account behind this credential processes requests, used for routing eligibility on OpenRouter's regional hosts. null means undeclared and global is behaviorally identical: the credential follows the region OpenRouter records for the endpoint. europe or us lets requests to eu.openrouter.ai or us.openrouter.ai use this credential for that provider (private endpoints, endpoints pinned to another cloud region, cross-region inference profiles and video models are excluded). Self-declared and not verified by OpenRouter. For OpenAI and Fireworks the region comes from the key material (a {"api_key": ..., "region": ...} key), so the value must match the key's region. Among other providers, only Azure accepts europe or us. Defaults to the key's region for OpenAI and Fireworks, otherwise null.

Available options:
global,
europe,
us,
null
Example:

null

declared_zdr
boolean | null

Your declaration of whether the upstream provider account behind this credential has zero data retention (ZDR). null inherits OpenRouter's data policy for the provider's endpoint; true declares the account ZDR so requests that require ZDR may route to this credential even when the shared endpoint retains data; false declares it non-ZDR so such requests never route to it. Self-declared and not verified by OpenRouter. Defaults to null.

Example:

null

disabled
boolean

Whether this credential should be created in a disabled state.

Example:

false

is_byok_only
boolean

Whether OpenRouter's shared endpoints on this provider are removed for every model, including models outside allowed_models and after all of your keys for the provider fail. The provider is skipped instead of spending OpenRouter credits. Only valid on non-fallback credentials. Defaults to false.

Example:

false

is_fallback
boolean

Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried. Cannot be combined with is_byok_only.

Example:

false

is_required
boolean

Whether OpenRouter's shared endpoints on this provider are removed for the models this credential applies to (its allowed_models, or every model when null). Requests for those models run only on your keys; models outside the allowlist may still fall back to shared capacity on this provider. Defaults to false.

Example:

false

name
string | null

Optional human-readable name for the credential.

Maximum string length: 255
Example:

"Production OpenAI Key"

workspace_id
string<uuid>

Optional workspace ID to scope the credential to. When omitted, the credential is created in the account's default workspace; if that default has been deleted, the request returns a 400 and you must pass workspace_id explicitly.

Example:

"550e8400-e29b-41d4-a716-446655440000"

Response

BYOK credential created successfully

data
object
required

The created BYOK credential.

Example: