Bring your own provider key

Bring your own key (BYOK) lets you use your account with an enabled AI provider while still using PortModels as the consistent interface for model requests. You can choose a configured provider in the web app, or send the encrypted BYOK envelope with an API request.

PortModels keeps the public model id and provider route separate:

• model is the logical model key, such as deepseek-ai/DeepSeek-V3.
• provider is the provider route you choose.
• provider_key is an encrypted envelope, never a plaintext provider key.

For automatic routing, leave the provider choice on Automatic. To pin a request to a provider, first configure an encrypted key for that provider.

Before you start#

You need an active key from a provider that PortModels has enabled for the model you want to use. The provider account pays the provider's own inference bill. PortModels charges its separate BYOK routing fee after a successful request; the current fee is controlled by PortModels and shown in the product.

Your provider's terms, limits, and spending controls still apply. Set a limit with the provider if it offers one, and rotate the key at the provider if you ever suspect that it was exposed.

Configure a key in the web app#

1. Open Settings and choose Provider keys.
2. Select the provider, enter its key, and save it.
3. PortModels encrypts the key in your browser before the key leaves your device.
4. Open Chat and choose the provider key when you want to use that provider.

The browser stores only the encrypted envelope for that user and provider. It does not submit or store the plaintext key as a PortModels account value. You can remove the saved envelope from Provider keys when you no longer want that browser to keep it.

How the protection works#

The setup and request flow is:

1. The browser receives PortModels' public encryption information.
2. Web Crypto creates an ephemeral P-256 key pair and derives a shared secret with PortModels' public key.
3. HKDF-SHA-256 derives an encryption key, and AES-256-GCM encrypts the provider key with a fresh random salt and IV.
4. The encrypted envelope is bound to your PortModels user id and the chosen provider. Changing either context makes validation fail.
5. The browser keeps the envelope locally and sends it with a BYOK request.
6. PortModels decrypts it only in short-lived request memory, uses the credential to make the upstream request, and does not persist the plaintext key.

User keys and BYOK envelopes are not stored in the PortModels account database. They are not written to call logs, billing records, or provider settings. Request logging also redacts provider keys, authorization values, and nested credential-shaped fields.

This means a database-only breach does not reveal the provider keys handled by BYOK. Authenticated encryption also detects modified envelopes, and an envelope copied to another user or provider cannot be opened in that context.

Use BYOK through the API#

The OpenAI-compatible chat endpoint accepts provider and provider_key as PortModels extensions:

{
  "model": "deepseek-ai/DeepSeek-V3",
  "messages": [
    {"role": "user", "content": "Hello"}
  ],
  "provider": "your-configured-provider",
  "provider_key": "pmbyok:v1:..."
}

The provider_key value above is an example shape, not a key to copy. Create the envelope in the PortModels web app or implement the documented envelope protocol in your own trusted client. Never send a plaintext provider key in an API request, query string, log, or source repository.

Both fields are required together. The selected provider must have an active route for the logical model, and a provider-specific request is pinned to that provider rather than failing over to another provider that cannot use the same key.

The same BYOK fields are supported by image and video requests where the selected provider has an active route. See the chat completions API reference for the common request format.

What PortModels can and cannot protect#

BYOK is designed to reduce the impact of a database-only compromise:

• the database does not contain the plaintext provider key;
• the database does not contain the encrypted browser envelope;
• the server decryption material is kept in the deployment environment, outside PostgreSQL;
• the server does not persist the plaintext key after the request.

PortModels must briefly decrypt the key to authenticate the upstream request. This is not zero-knowledge encryption. A person who controls the running PortModels process or host could potentially inspect a key while its request is being handled. A valid envelope for the same signed-in account and provider is also sensitive and should be protected in the browser.

Use HTTPS, keep your account and browser secure, do not paste keys into chats or tickets, and rotate a provider key if you suspect the browser or account was compromised.

Frequently asked questions#

Does PortModels store my provider key?#

PortModels does not persist the plaintext key or the BYOK envelope in your account database. The browser keeps the encrypted envelope so it can be used again from that browser. The server opens it only when a request needs it.

Can PortModels call the provider without seeing the key?#

No. The server must access the credential briefly to send the provider's authorization header. The security benefit is that there is no persistent plaintext copy in the account database or routine request records.

Can I choose any provider for any model?#

You can choose among providers that PortModels has enabled and configured for that model. Automatic routing remains available when you do not want to pin a provider. A provider-specific route requires a matching BYOK key.

What happens if I rotate my provider key?#

Replace the saved key in Settings → Provider keys. If a deployment key rotation invalidates existing envelopes, the UI will ask you to enter the provider keys again.

Who pays for a BYOK request?#

Your provider account pays the provider's inference charge. PortModels applies its separate routing fee, and a connected app may apply its own clearly separated markup.