Bring Your Own Keys

TrustedRouter OpenRouter Concentrate AI Requesty Self-Hosting
“Bring Your Own Keys” is a flexible control pattern: in security it means customers control encryption keys, while in AI tools it usually means you supply your own model API key instead of using the vendor’s. [laktr0] [zom29a] [2eymil]
Bring Your Own Keys (BYOK) is used in at least two closely related but distinct ways. In cloud security, it refers to a customer-managed encryption model in which the customer generates, imports, stores, or governs the key material used to protect data. [zom29a] [jazxs0] [c36w17] In AI software, it usually means an application lets you connect your own provider API key, so usage is billed and governed by the provider account you control rather than by the app vendor’s pooled key. [laktr0] [2eymil] [0k2c32]

Defining and Describing Bring Your Own Keys

flowchart TD A["Bring Your Own Keys"] A --> B["Cloud security BYOK"] A --> C["AI app BYOK"] B --> D["Customer controls encryption keys"] B --> E["Used for compliance and data control"] C --> F["User supplies provider API key"] C --> G["App calls model under user's account"]

Uses in Context

  • In cloud platforms, BYOK describes a setup where “customers of a cloud service provider (CSP) generate and manage their own encryption keys.” [zom29a]
  • Oracle uses the term for environments where users “use and manage your own encryption keys” instead of the service’s default Oracle-managed TDE key. [jazxs0]
  • Salesforce describes BYOK as a way to “bring key material from outside of Salesforce,” with customers generating it via their own crypto libraries, enterprise key management system, or hardware security module. [d57zvt]
  • In JetBrains AI Assistant, BYOK means using “models from a supported AI provider by providing your own API key.” [laktr0]
  • Raycast uses the term for connecting “your own API key from Anthropic, Google, or OpenAI” to its AI features. [2eymil]
  • Cloudflare AI Gateway uses “bring your own keys” to mean securely storing provider API keys in its dashboard and referencing them in gateway configuration. [0k2c32]

History of Use

Origins

Bring Your Own Key first appears as a cloud-security and encryption term, not as an AI product term. [zom29a] [jazxs0] [c36w17] IBM defines it as an encryption key management approach in which cloud customers “generate and manage their own encryption keys,” which reflects the core security meaning now common across enterprise cloud services. [zom29a] Oracle and Salesforce later use the same acronym for managed-cloud encryption controls, showing that the term spread as a customer-control pattern across SaaS and infrastructure products. [jazxs0] [c36w17] [d57zvt]

Evolution

  • By 2025, JetBrains was using BYOK for AI assistants, defining it as a way to use provider models by “providing your own API key.” [laktr0]
  • By 2026, Raycast, Cloudflare AI Gateway, and other AI tooling had adopted the term for API-key management in AI workflows, extending the phrase from encryption-key governance into model-access and billing control. [2eymil] [0k2c32]
  • In 2026, BYOK remained a dual-use term across enterprise software: security vendors and cloud providers kept the encryption meaning, while AI tools used it for bring-your-own-provider credentials. [zom29a] [2eymil] [0k2c32]

Best Real-World Examples

  • JetBrains AI Assistant — supports BYOK by letting users provide their own API key for supported AI providers. [laktr0]
  • Raycast AI — lets users connect their own Anthropic, Google, or OpenAI key to AI features. [2eymil]
  • Cloudflare AI Gateway — stores provider API keys in the dashboard and reuses them in gateway configuration. [0k2c32]
  • IBM BYOK — presents BYOK as a customer-managed encryption-key model for cloud services. [zom29a]
  • Oracle BYOK — uses customer-managed keys stored in OCI Vault for Oracle cloud applications. [jazxs0]
  • Salesforce BYOK — gives customers control over encryption keys used for cloud data. [c36w17]
  • Salesforce Shield BYOK — describes customer-generated key material from external crypto tools or an HSM. [d57zvt]

Case Studies

JetBrains shows the AI version of BYOK in a concrete workflow: the AI Assistant plugin lets users select a provider, enter a key, and then use models from that provider inside the IDE. [laktr0] The company’s documentation frames BYOK as a practical configuration choice rather than a new model architecture, which is important because it shows how the term has shifted from security policy into developer-tool UX. [laktr0]
Cloudflare’s AI Gateway uses BYOK as an operational control layer, where API keys are stored once in the dashboard and then referenced across requests instead of being passed repeatedly. [0k2c32] That implementation matters because it emphasizes key storage and routing convenience, while still leaving billing and access tied to the user’s provider account. [0k2c32]
In enterprise security, Oracle and Salesforce illustrate the older, stricter meaning of BYOK: customers manage encryption keys that protect cloud data rather than relying entirely on provider-held keys. [jazxs0] [c36w17] [d57zvt] This version of BYOK is about custody and compliance, and it shows the concept’s roots in cryptographic control before the phrase was repurposed by AI tooling for API-key delegation. [zom29a] [jazxs0] [c36w17] [d57zvt]

Sources