> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gatelit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring Your Own Key (BYOK)

> Supply your own OpenAI, Anthropic, Google, or Mistral API keys so Gatelit routes your requests through your provider accounts.

By default, Gatelit routes requests through shared provider keys managed by Gatelit. With BYOK (Bring Your Own Key), your organization supplies its own provider API keys. All requests from your org are then routed through your accounts — giving you full control over rate limits, spend visibility, and provider billing.

## Supported providers

| Provider  | Key format           |
| --------- | -------------------- |
| OpenAI    | `sk-...`             |
| Anthropic | `sk-ant-...`         |
| Google    | Your Gemini API key  |
| Mistral   | Your Mistral API key |

## Adding a provider key

1. In the Gatelit dashboard, navigate to **Settings → Provider Keys**.
2. Select the provider you want to configure.
3. Paste your API key into the input field and click **Save**.

Once saved, all requests from your organization automatically use your key for that provider. No code changes are required on the client or gateway side.

<Note>
  You can add a key for some providers and rely on Gatelit's shared keys for others. For example, you might supply your own OpenAI key while continuing to use the shared Anthropic key.
</Note>

## Embedding your org ID in signed tokens

When you issue signed tokens from your backend, include your organization's `orgId` so the gateway can look up your org's provider keys for every request:

```ts theme={null}
import { signToken } from "@gatelit/sdk/sign"

const token = await signToken(
  {
    sub: user.id,
    orgId: "org_abc123", // your Gatelit organization ID
    ttl: 60,
  },
  process.env.GATELIT_SIGNING_SECRET!,
)
```

The `orgId` is embedded in the signed token payload. The gateway reads it on every request to resolve which provider keys to use for your organization. Without `orgId`, the gateway falls back to Gatelit's shared keys.

## Security

<Warning>
  Provider keys are encrypted at rest and are never exposed in plain text after storage. You cannot retrieve a stored key from the dashboard — if you need to rotate it, delete the existing entry and add the new key.
</Warning>

Keys are scoped to your organization and are never shared with other Gatelit customers.

## Deleting a provider key

To remove a key, navigate to **Settings → Provider Keys**, find the provider entry, and click **Delete**. After deletion, requests for that provider automatically fall back to Gatelit's shared key.