Create a BYOK provider credential
Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When workspace_id is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass workspace_id explicitly. Treat the raw key as write-only; it is never returned after creation. Management key required.
Authorizations
API key as bearer token in Authorization header
Body
The raw provider API key or credential. This value is encrypted at rest and never returned in API responses.
1"sk-proj-abc123..."
The upstream provider this credential authenticates against, as a lowercase slug (e.g. openai, anthropic, amazon-bedrock).
ai21, aion-labs, akashml, alibaba, amazon-bedrock, amazon-nova, ambient, anthropic, arcee-ai, atlas-cloud, avian, azure, baidu, baseten, black-forest-labs, byteplus, cerebras, chutes, cirrascale, clarifai, cloudflare, cohere, coreweave, crusoe, darkbloom, decart, deepgram, deepinfra, deepseek, dekallm, digitalocean, featherless, fireworks, fish-audio, friendli, gmicloud, google-ai-studio, google-vertex, groq, heygen, inception, inceptron, inferact-vllm, inference-net, infermatic, inflection, io-net, ionstream, krea, liquid, mancer, mara, meta, minimax, mistral, modal, modelrun, modular, moonshotai, morph, ncompass, nebius, nex-agi, nextbit, novita, nvidia, open-inference, openai, parasail, perceptron, perplexity, phala, poolside, quiver, recraft, reka, relace, runway, sail-research, sakana, sakana-ai, sambanova, seed, siliconflow, sourceful, stepfun, streamlake, switchpoint, tencent, tenstorrent, thinkingmachines, together, upstage, venice, wafer, wandb, wandb-legacy, xai, xiaomi, z-ai "openai"
Optional allowlist of model slugs this credential may be used for. null means no restriction.
100null
Optional allowlist of user IDs that may use this credential. null means no restriction.
100null
Whether this credential should be created in a disabled state.
false
Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
false
Optional human-readable name for the credential.
255"Production OpenAI Key"
Optional workspace ID to scope the credential to. When omitted, the credential is created in the account's default workspace; if that default has been deleted, the request returns a 400 and you must pass workspace_id explicitly.
"550e8400-e29b-41d4-a716-446655440000"
Response
BYOK credential created successfully
The created BYOK credential.