Create a BYOK provider credential
Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When workspace_id is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass workspace_id explicitly. Treat the raw key as write-only; it is never returned after creation. Use allowed_api_key_hashes to restrict the credential to specific OpenRouter API keys. Management key required.
Authorizations
API key as bearer token in Authorization header
Body
The raw provider API key or credential. This value is encrypted at rest and never returned in API responses.
1"sk-proj-abc123..."
The upstream provider this credential authenticates against, as a lowercase slug (e.g. openai, anthropic, amazon-bedrock).
ai21, aion-labs, akashml, alibaba, amazon-bedrock, amazon-nova, ambient, anthropic, arcee-ai, atlas-cloud, avian, azure, baidu, baseten, black-forest-labs, byteplus, cerebras, chutes, cirrascale, clarifai, cloudflare, cohere, coreweave, crusoe, darkbloom, databricks, decart, deepgram, deepinfra, deepseek, dekallm, digitalocean, featherless, fireworks, fish-audio, friendli, gmicloud, google-ai-studio, google-vertex, groq, heygen, inception, inceptron, inferact-vllm, inference-net, infermatic, inflection, io-net, ionstream, krea, liquid, mancer, mara, meta, minimax, mistral, modal, modelrun, modular, moonshotai, morph, ncompass, nebius, nex-agi, nextbit, novita, nvidia, open-inference, openai, parasail, perceptron, perplexity, phala, poolside, quiver, recraft, reka, relace, runway, sail-research, sakana, sakana-ai, sambanova, seed, siliconflow, sourceful, stepfun, streamlake, switchpoint, tencent, tenstorrent, thinkingmachines, together, upstage, venice, wafer, wandb, wandb-legacy, xai, xiaomi, z-ai "openai"
Optional allowlist of OpenRouter API key hashes (api_keys.hash) that may use this credential. null means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.
1 - 100 elements^[a-f0-9]{64}$Optional allowlist of model slugs this credential may be used for. null means no restriction.
100null
Optional allowlist of user IDs that may use this credential. null means no restriction.
100null
Whether this credential should be created in a disabled state.
false
Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
false
Optional human-readable name for the credential.
255"Production OpenAI Key"
Optional workspace ID to scope the credential to. When omitted, the credential is created in the account's default workspace; if that default has been deleted, the request returns a 400 and you must pass workspace_id explicitly.
"550e8400-e29b-41d4-a716-446655440000"
Response
BYOK credential created successfully
The created BYOK credential.