Create a BYOK key

Creates a BYOK upstream key for the organization and immediately syncs the model catalog. The upstream apiKey appears in plaintext only in this request — it is encrypted at rest and only ever returned masked (keyMask). On success answers 201 with the key object and the model sync result (sync).

POST/api/v1/management/byok-keys

Authorizations

Authorizationrequired

string · header

API key as bearer token in the Authorization header.

Body

namerequired

string

Display name for the key.

1-200 chars

baseUrlrequired

string

The upstream provider's API base URL. Private or local addresses are rejected (400).

1-2000 chars, public HTTPS endpoint

apiKeyrequired

string

The upstream provider's API key in plaintext. Appears only in this request; encrypted at rest, only keyMask is returned afterwards.

1-2000 chars

protocol

string

The upstream's API interface protocol; defaults to openai.

openaianthropic

Example: "openai"

fallbackMode

string

Behavior when the upstream fails: seamless (default) falls back to platform routing; strict does not fall back and returns the error.

seamlessstrict

Example: "seamless"

disabledCanonicalIds

string[]

Models (canonical ids) to disable at creation; after sync these models will not route through this key.

≤2000 items

scopedApiKeyIds

string[]

Restricts this BYOK key to specific platform API keys (by key id). Empty/omitted = applies to every key of the org. Including a key id you don't own is rejected (400).

≤200 items; must be your own keys

POST /api/v1/management/byok-keys

1
2
3
4
5
6
7
8
9
10
curl https://bazaarlink.ai/api/v1/management/byok-keys \
  -H "Authorization: Bearer $BAZAARLINK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "team-upstream",
    "baseUrl": "https://api.example-upstream.com/v1",
    "apiKey": "'$UPSTREAM_API_KEY'",
    "protocol": "openai",
    "fallbackMode": "seamless"
  }'

Response examples

Created. key is the key object (keyMask only); sync reports the model catalog sync: matched (models mapped to the platform catalog), unmatched (upstream model ids absent from the platform catalog), stale (whether a later re-sync is needed).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "key": {
    "id": "byok_abc123",
    "ownerType": "org",
    "userId": null,
    "organizationId": "org_abc123",
    "name": "team-upstream",
    "baseUrl": "https://api.example-upstream.com/v1",
    "keyMask": "sk-abc…wxyz",
    "protocol": "openai",
    "enabled": true,
    "fallbackMode": "seamless",
    "modelsStale": false,
    "lastVerifiedAt": "2026-07-29T00:00:00.000Z",
    "lastErrorAt": null,
    "lastErrorCode": null,
    "errorCount1h": 0,
    "createdAt": "2026-07-29T00:00:00.000Z",
    "updatedAt": "2026-07-29T00:00:00.000Z",
    "models": [
      {
        "canonicalId": "openai/gpt-4o",
        "upstreamModelId": "gpt-4o",
        "enabled": true
      }
    ],
    "scopedApiKeyIds": []
  },
  "sync": {
    "matched": 12,
    "unmatched": [
      "internal-model-x"
    ],
    "stale": false
  }
}