Use the account you control
Connect supported providers under your own organization. Your provider contract, limits, and upstream charges still belong to that account.
Your provider accounts
Bring your own AI provider keys to one gateway
Direct provider accounts can offer the terms or capacity your team needs, but each one has different credentials and failure signals. LLMRegistry puts those accounts behind one request interface and one routing layer.
- Credential storage
- Encrypted with AES-256-GCM
- Activation
- After a real request succeeds
- Fallback
- Only when policy allows
Keep your provider relationship and simplify application code
Your organization owns each connected provider account. Applications use LLMRegistry keys and route names instead of carrying every upstream secret.
Keep secrets out of normal views
Credentials are encrypted before storage. Lists, audit events, exports, and usage records expose only a safe hint, never the raw provider key.
Choose strict or mixed behavior
A route can require your connections or allow pooled capacity as an explicit fallback. The gateway does not silently change modes.
How a provider connection becomes ready
A key that has the right shape is not proof that the provider will accept it.
Check the connection details
LLMRegistry checks the provider type, fields, endpoint rules, and credential shape before saving the encrypted connection.
Start in a pending state
A new or rotated connection stays pending. Structural checks do not label it healthy before real provider work.
Prove it with inference
The first successful request marks the connection healthy. A provider authentication failure removes the bad credential from dispatch.
Watch health over time
Repeated temporary provider failures can open a circuit. Traffic is held back during cooldown, then a limited test checks recovery.
Decide when BYOK should be used
Provider mode is a route decision, so cost and reliability behavior remain clear.
BYOK is useful when
- You already have provider pricing, credits, or capacity.
- You need a certain provider region or account policy.
- You want central routes without moving upstream ownership.
- You need encrypted credential rotation and health tracking.
Remember these boundaries
- Provider terms and data handling still apply to each request.
- Provider charges are separate from LLMRegistry charges.
- A strict BYOK route can stop when your approved connections are unavailable.
- A pooled fallback runs only when the route explicitly permits it.
Related controls
Use your provider accounts without spreading their keys
Keep credentials in one encrypted control point and make routing behavior explicit.
Get started