BYOK vs Platform Key: when to use which

apitree supports two credential models for upstream providers. Both work transparently through the same proxy endpoint.

BYOK (Bring Your Own Key)

You have an OpenAI account. You pay OpenAI directly. You want apitree’s caching, monitoring, MCP integration, and unified billing for everything else — but you don’t want to re-procure keys you already have. Use BYOK.

Add your key at /settings/byok. apitree encrypts it with AES-256-GCM at rest and injects it on every call. The key never leaves our infrastructure.

Platform Key

You don’t have a relationship with the provider yet. Or you want to avoid managing 15 provider accounts. apitree procures the key, handles rotation, pays the provider, and bills you in credits. This is the default for most APIs.

The rule of thumb

If your company already has enterprise contracts with OpenAI, Anthropic, or similar — use BYOK for those specific ones. For everything else (public data, niche AI models, 1,950+ APIs you’d never procure individually) — let apitree handle it.