Docs

Org provider keys (Vertex, Together, OpenAI, …) encrypted at rest. The secret is never returned.

Bring your own keys

Store an upstream provider secret on the organization. The gateway uses that key for the matching slug before the platform env key, then falls through unless alwaysUse is set or provider.allow_fallbacks is false.

The raw secret is encrypted (AES-256-GCM) and never returned after create. List responses show providerSlug, label, keyPrefix (for example sk-a…xyz1), and alwaysUse. Saving a second key for the same slug rotates the active row (old secret is revoked immediately).

Dashboard

Dashboard → API keys (Bring your own key section), or
Settings → Provider Keys

Allowed slugs: vertex, together, openai, anthropic, google, cohere, mistral, deepseek, qwen, groq, xai, azure-foundry, cerebras, perplexity.

alwaysUse pins that slug to the front of the chat provider chain.

Gateway API

Same objects, API-key auth:

GET    /v1/byok
POST   /v1/byok
DELETE /v1/byok/:id

bash
export OPENDOOR_API_KEY=opd_…
export OPENDOOR_BASE_URL=https://opendoor-gcp.web.app

curl "$OPENDOOR_BASE_URL/v1/byok" \
  -H "Authorization: Bearer $OPENDOOR_API_KEY"

curl "$OPENDOOR_BASE_URL/v1/byok" \
  -H "Authorization: Bearer $OPENDOOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "providerSlug": "vertex",
    "apiKey": "YOUR_PROVIDER_SECRET",
    "label": "Prod Vertex",
    "alwaysUse": false
  }'

provider is accepted as an alias for providerSlug; secret is accepted as an alias for apiKey. The 201 body is the public row only — no secret field.

ts
await client.byok.create({
  providerSlug: "together",
  apiKey: process.env.TOGETHER_API_KEY,
  label: "Together overflow",
});

GCP on the team page

Dashboard → Team can store a Google Cloud project id and last-sync time for the workspace (google-mcp). That metadata is not a provider secret and is not echoed as a key. Platform Vertex chat / Search still use OpenDoor’s Cloud Run service account unless you add a vertex BYOK row.

Chat

After a vertex (or together, …) key is saved, POST /v1/chat/completions can prefer that slug:

json
{ "provider": { "order": ["vertex"], "allow_fallbacks": true } }

See Chat and BYOK API.

Dashboard

Playground