BYOK (Bring Your Own Key)

BYOK lets you use your own AI provider credentials while still getting Veriprompt's intelligent routing, safety features, and analytics.

Why Teams Use BYOK

• Keep billing with your provider - Use your existing enterprise agreements and volume discounts
• Control which models are available - Define exactly which models your team can access
• Separate dev and production credentials - Use different keys for different environments
• Compliance requirements - Meet data residency requirements by specifying provider locations
• Cost transparency - Track usage per credential with detailed analytics

Getting Started

Adding a New API Key

1. Navigate to Settings > API Credentials in the dashboard
2. Click Add API Key
3. Select the provider and model from the catalog
4. Enter your API key
5. Optionally add a nickname (e.g., "Production Key", "Testing Key")
6. Choose ownership: Company Key (shared) or Personal Key

Location & Compliance Options

When adding or editing a credential, you can expand the Location & Compliance Options section to specify:

Country

Select the country where your AI provider processes data. This is used for:

• Geofencing rules to ensure data stays within specific regions
• Routing decisions based on data residency requirements
• Compliance with regulations like GDPR, LGPD, etc.

Common locations:

• US - United States (most major providers)
• DE - Germany (EU-compliant options)
• GB - United Kingdom
• JP - Japan
• SG - Singapore (APAC region)

Region/Datacenter

Specify the exact datacenter or region, such as:

• us-east-1 - AWS US East
• eu-west-1 - AWS EU West
• asia-southeast1 - GCP Singapore

Expected IP Ranges

For advanced security, specify the IP ranges (in CIDR notation) that the provider should connect from:

• 104.18.0.0/16 - Example range
• Multiple ranges can be comma-separated

This helps with:

• Validating that responses come from expected infrastructure
• Detecting potential man-in-the-middle scenarios
• Audit and compliance logging

Compliance Tags

Mark credentials with relevant compliance frameworks:

• GDPR - EU General Data Protection Regulation
• HIPAA - Healthcare (US)
• SOC2 - Service Organization Control 2
• ISO27001 - Information Security Management
• PCI-DSS - Payment Card Industry
• CCPA - California Consumer Privacy Act
• LGPD - Brazil's Data Protection Law

These tags are used by routing policies to ensure prompts are only sent to compliant providers.

Credential Management

Validating Credentials

Click the Validate button to test that your API key is working. The system will make a minimal test call to verify:

• The key is valid and active
• The provider endpoint is reachable
• Response latency is measured

Active/Inactive Status

Toggle credentials between Active and Inactive states:

• Active - Available for routing and execution
• Inactive - Excluded from routing (preserved for future use)

Bulk Import

Import multiple credentials at once using CSV or Excel files:

1. Click Import in the credentials section
2. Download the template file
3. Fill in your credentials with columns:
   • provider - Provider name (openai, anthropic, google)
   • model - Model ID (gpt-4, claude-3-opus)
   • api_key - Your API key
   • nickname - Optional friendly name
   • owner_type - COMPANY or USER
4. Upload and import

Access Policies

Your organization's access policy determines what you can do with credentials:

Policy	Description
Platform Keys	Use Veriprompt-provided shared credentials
Company Keys	Use credentials shared across your organization
Personal Keys	Use your own individual credentials
Require BYOK	Must use your own keys (platform keys disabled)

Contact your administrator to adjust these policies.

Security Best Practices

1. Use separate keys for environments - Don't share production keys with development
2. Rotate keys regularly - Replace credentials periodically
3. Set expiration dates - Configure keys to expire when projects end
4. Specify locations - Always set country/region for compliance tracking
5. Enable compliance tags - Mark credentials with relevant frameworks
6. Monitor usage - Review analytics for unusual patterns

Integration with Routing

BYOK credentials integrate with Veriprompt's intelligent routing:

• Geofencing - Routes are filtered based on credential location
• Compliance filtering - Only compliant credentials are considered
• Cost optimization - BYOK costs are tracked separately
• Fallback handling - Platform keys can serve as fallback when BYOK fails

Hybrid Provider Assignment (Pooled + BYOK)

Every chat category (and the routing policy behind it) has a provider sourcing mode that decides where requests in that category get their provider credentials from. There are three modes:

Mode	Where requests run	Typical use
POOLED	Veriprompt's shared platform provider pool	Everyday, lower-sensitivity traffic where cost and convenience matter most
PASS_THROUGH	Your company's own BYOK credentials only — the prompt is sent using your provider keys	Sensitive traffic, or when a classification sets requiresPassThrough / your access policy sets Require BYOK
HYBRID	A blend of both — pooled providers and your company's BYOK keys in one policy	When you want BYOK where it's available but a pool fallback so requests never get stuck

Why this matters

A common setup uses different modes per category:

• A "General" category stays POOLED so routine questions use the shared pool and stay cheap.
• A "Confidential" category is set to PASS_THROUGH (or HYBRID) so sensitive prompts only ever travel over your own provider keys — keeping the data inside your provider contract and data-residency boundary.

If a classification is marked as requiring pass-through (requiresPassThrough), Veriprompt enforces it server-side: a category that isn't PASS_THROUGH will be rejected for that classification. Likewise, if your access policy sets Require BYOK, platform pool keys are disabled and requests must use your own credentials.

Walk-through: assigning providers in each mode

You configure modes under Admin → Chat Settings → Chat Categories. Your BYOK keys come from Settings → Credentials.

POOLED example

1. Open Admin → Chat Settings → Chat Categories and create or edit a category, e.g. General.
2. Set Mode to POOLED.
3. Save. Requests in this category are routed across the shared platform pool by the routing policy — no BYOK key is attached.

PASS_THROUGH example

1. First add your provider key under Settings → Credentials (e.g. a Company OpenAI key).
2. Open Admin → Chat Settings → Chat Categories, create or edit a category, e.g. Confidential.
3. Set Mode to PASS_THROUGH.
4. Select the pass-through credential to use (this is required for PASS_THROUGH). All prompts in this category are sent using that key only.
5. Save. Sensitive prompts now run exclusively on your own credentials.

HYBRID example

1. Add one or more provider keys under Settings → Credentials.
2. Open Admin → Chat Settings → Chat Categories, create or edit a category, e.g. Confidential (resilient).
3. Set Mode to HYBRID.
4. Attach at least one BYOK credential (required for HYBRID), and choose whether to prefer BYOK first.
5. Save. Requests now try your BYOK key and the pool together — using BYOK where available and falling back to (or mixing with) the pool so a single key outage never blocks the category.

Per-User Provider & Quality Profiles

Beyond company-wide categories, each user can set their own default provider and default quality tier for chat and Guru. These are stored as a per-user preference:

• defaultProvider — your preferred provider (e.g. anthropic). Set it to auto to let Veriprompt's routing decide for you.
• defaultQuality — your preferred quality tier, one of:
  • cheap — lowest cost
  • fast — quickest responses (the default)
  • quality — highest-capability models
  • secure — privacy/compliance-oriented models

These per-user defaults act as a fallback for Guru chat, Guru explain/refine, and the chat terminal whenever no more specific choice applies.

How precedence works

Veriprompt picks a provider in this order — the first one that applies wins:

1. Explicit selection in the request — a provider or model you pick directly for that message.
2. Category / policy routing — the routing rules of the chat category you're using (including POOLED / PASS_THROUGH / HYBRID above).
3. Your own default profile — your defaultProvider and defaultQuality.
4. Company default — the organization-wide fallback.

Example: You set defaultProvider: "anthropic" and defaultQuality: "quality". When you open a chat in a category that has no specific provider routing and don't pick a provider for the message, Guru uses Anthropic at the quality tier. If you instead set defaultProvider: "auto", Veriprompt's router chooses the best provider for you at the quality tier. If the category itself is set to PASS_THROUGH, that category routing takes priority over your personal default.

Learn More

• Intelligent Routing
• Geofencing Policies
• IP Security Architecture
• Provider Catalog