Connect a provider

The current Account Owner connects their own provider API keys as a BYOK channel on the workspace's BYOK page. The editor has four steps, Provider & billing, Credentials, Models & cost and Usage, and Test connection checks that every credential can reach the provider before you save. Changes reach the gateway within seconds of saving, and every API key in the workspace can then call the selected models through the channel.

Before you start

• Permissions: only the current Account Owner can see and manage this page. Account Members do not see the menu, but they can call configured BYOK sources with their own API keys.
• What you need: the provider's API key. A custom provider also needs a Base URL and an interface type. Before connecting a Coding Plan, read API services and Coding Plans.
• Limits: within a workspace, each provider channel can have only one BYOK, and providers already connected are greyed out. One BYOK can hold several API keys. A personal account can create up to 3 BYOK channels across all of its workspaces.

Click Add BYOK to open the editor. Click Next after each step; completed steps can be reopened at any time.

Step 1: Provider & billing

For a custom provider, the Interface determines how to write the Base URL:

Figure 1: Step 1 selects the provider and billing mode and shows the Base URL of the current access configuration. Demonstration data; click the image for full size.

Step 2: Credentials

Each row is one API key. Click Add a credential from another account below the table to add a row:

• Within one channel the gateway tries credentials by priority and moves to the next when one fails or has reached its limit; see Retries and fallback.
• Most providers limit concurrency per upstream account, so extra keys from the same account do not raise total concurrency. For more concurrency, add keys created under different accounts.
• Newly added credentials are always saved as enabled. To keep one disabled, save first, then edit again and turn off Enabled.

Figure 2: Step 2 manages credentials by priority; leave a saved key blank to keep it unchanged. Demonstration data; click the image for full size.

Step 3: Models & cost

• Built-in providers: the table lists the models the platform has published for the channel, marked Built in; no model mapping required. All models are selected by default for a new BYOK; clear the ones you do not need. With Token-based billing, the table shows input and output list prices and a Channel price discount (%) (100 means list price). Models whose list price shows Pending cannot be saved; clear them.
• Custom providers: click Fetch provider models and map upstream models to platform models; see Model mappings and sources.
• Subscription billing: fill in Subscription amount, Currency, Cycle and Starts at.

The list price multiplied by the discount is this channel's price for Lowest Price sorting and is also used to estimate BYOK costs.

Step 4: Usage

Both preferences apply per model: in a workspace, only one BYOK can set Prefer or Only use for a given model. They take precedence over the multi-channel routing strategy; see Channels and routing.

Figure 3: Step 4 distinguishes Prefer this Channel from Only use this BYOK. Demonstration data; click the image for full size.

Test connection

• Test connection at the bottom tests every credential; Test in the Connection test column tests one row.
• The test reads the provider's model list with the credential; built-in providers use the address of the current access configuration. Each row shows Connected · N ms or Authentication failed, and the bottom bar summarizes Done: N/M credentials reachable.
• Authentication failed covers every failure: an invalid key, a wrong address or interface type, a network problem, or a provider without a model list endpoint. Check each in turn.
• The test is advisory and never blocks saving. If any credential is untested or failed, tick I understand the connection test failed or was skipped and want to save anyway in the Usage step. When you edit an existing BYOK, credentials not tested in this session also count as untested.

Save and verify

Click Save configuration. After the message Saved "name"; background health check started…, you return to the list. New credentials are checked once automatically, and the result appears in the Status column. The selected models gain a BYOK source in the model marketplace and are enabled by default.

Call a selected model once with an API key from the workspace; environment variables are set up in Your first model call:

curl "$LYROUTER_BASE_URL/v1/chat/completions" \
  -H "Authorization: Bearer $LYROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"deepseek/deepseek-v4-pro","messages":[{"role":"user","content":"ping"}]}'

In the request logs, the call shows a BYOK tag next to Provider, and under Hit upstream in the log details' Route trace, the source is User.

Common save errors

Managing an existing BYOK

Each row in the list has edit, enable / disable and delete buttons, in that order. Disabling stops new requests immediately while in-flight requests continue, and you can re-enable it at any time. Deleting requires typing the provider name and clicking Delete permanently; usage and logs already recorded are kept. To replace keys, reorder credentials or set limits, see BYOK fees and credentials.