Bring your own keys

Your keys, our gateway. Everything else on credits. nRouter manages provider keys for you on credits by default, or you can bring your own OpenAI and Anthropic keys on the $20/mo Bring your own keys plan. Developers change nothing in their application code: keep the same sk-nrouter-* key, gateway endpoint, and SDK while every response reports who funded the call in the x-nr-funding-source header.

What BYOK is

Bring your own keys (BYOK) lets your organization route OpenAI and Anthropic text chat requests through the nRouter gateway using your own upstream provider accounts while keeping every other model and modality on prepaid nRouter credits.

• Zero code changes: Use the same sk-nrouter-* virtual key (API Key Management), endpoint, and SDK across all models.
• Direct provider billing: On BYOK requests, prompts go to your own OpenAI or Anthropic account and the provider bills you directly. nRouter charges $0 credits for those requests.
• Full gateway controls: Guardrails, rate limits, model access rules, and budgets still apply to every BYOK request.

Plan

nRouter offers two self-serve plans on Pricing:

• Supported providers: OpenAI and Anthropic only.
• Supported modality: Text chat (/v1/chat/completions and /v1/messages).
• Everything else on credits: Other providers, embeddings, audio, image, and video run on nRouter credits.
• Monthly token limit: 50M BYOK tokens per organization per calendar month (UTC) are included on the $20/mo plan. At the 50M token limit, BYOK requests are refused until the calendar month resets in UTC, while other models keep working on credits.

Add a key

Only Owners and org admins can add, replace, or remove provider keys.

1. Open the dashboard and navigate to the BYOK section directly below API Keys.
2. Paste your OpenAI or Anthropic key into the provider input.
3. Run the key check and confirm the status badge displays Working.

Once saved, your organization's existing sk-nrouter-* keys automatically use your configured provider key for eligible OpenAI and Anthropic text chat calls.

The one checkbox

In the BYOK section, you can configure one fallback setting:

• "If my key fails, use my nRouter credits"

When this checkbox is unticked, a failing provider key returns an error to the caller and never charges your nRouter credits. When this checkbox is ticked, if your provider key fails on a request, nRouter serves the call using your prepaid nRouter credits instead.

How to tell who paid

Every response includes headers (Response Headers) showing how the request was funded and settled:

Errors

When a BYOK request cannot be completed with your provider key (and credit fallback is either unticked or inapplicable), the gateway returns a structured error response (Errors & Rate Limits) with one of the following public codes:

Security

• Browser sealing & encryption: Keys are sealed in the browser before upload and stored encrypted.
• Masked display: After saving, nRouter shows only sk-…last4 and never displays the full key again.
• Role restrictions: Only Owners and org admins can add, replace, or remove keys.
• Direct provider account routing: On BYOK requests, prompts go to your own OpenAI or Anthropic provider account.

Limits

• Budgets: Budget Controls remain active on BYOK traffic. Budgets count an estimated cost at the nRouter list price for each BYOK request, which tracks gateway usage against your internal caps but cannot cap your upstream provider bill.
• Policies & rate limits: Guardrails, rate limits (Limits), and model access rules apply equally to BYOK and credit-funded requests.
• Other models and modalities: Models outside OpenAI and Anthropic, as well as embeddings, audio, image, and video endpoints, always run on nRouter credits (Billing & Credits).

Frequently asked questions