Bring Your Own Key

ORVEXA supports Bring Your Own Key (BYOK), allowing you to use your own provider API keys while benefiting from ORVEXA's routing, caching, and observability features.

What is BYOK?

BYOK lets you pass your own API key for upstream providers (such as OpenAI, Anthropic, or Google) in each request. ORVEXA acts as a proxy, routing your request through our infrastructure while using your key for the upstream provider's billing.

Benefits

Direct Provider Billing

Requests are billed directly by the upstream provider using your key, not through ORVEXA credits.

Full ORVEXA Features

You still get access to caching, guardrails, fusion, analytics, and all ORVEXA platform features.

No Vendor Lock-in

Maintain your existing provider relationships and negotiated rates while using ORVEXA as an orchestration layer.

Key Isolation

Each BYOK request uses your key only for that request. Keys are encrypted and never logged.

Using BYOK

Pass your provider key in the X-Orvexa-Provider-Key header along with your regular ORVEXA API key in the Authorization header.

X-Orvexa-Provider-Key

Optional

The raw API key for the upstream provider associated with the requested model. This key is used only for the current request and is encrypted in transit.

cURL with provider keybash

curl https://api.orvexaproject.com/v1/chat/completions \
  -H "Authorization: Bearer nx-sk-dcfab6de7407c3c5f74fb627" \
  -H "Content-Type: application/json" \
  -H "X-Orvexa-Provider-Key: sk-your-openai-key-here" \
  -d '{
    "model": "deepseek-chat",
    "messages": [
      {"role": "user", "content": "Hello from BYOK!"}
    ]
  }'

Python SDK Example

Python SDKpython

from openai import OpenAI

client = OpenAI(
    api_key="nx-sk-dcfab6de7407c3c5f74fb627",
    base_url="https://api.orvexaproject.com/v1",
)

response = client.chat.completions.create(
    model="deepseek-chat",
    messages=[{"role": "user", "content": "Hello!"}],
    extra_headers={
        "X-Orvexa-Provider-Key": "sk-your-provider-key-here"
    },
)

print(response.choices[0].message.content)

Encryption & Security

When you store a provider key in the ORVEXA Dashboard, it is protected using industry-standard encryption:

Each key is encrypted using AES-256-GCM with a unique data encryption key (DEK).

DEKs are wrapped by a master Key Encryption Key (KEK) stored in a dedicated KMS/HSM.

Only encrypted ciphertext is stored in the application database. Plaintext keys are never persisted.

Keys are decrypted only at request time in memory and are never written to logs or disk.

Encryption architecture (simplified)javascript

// ORVEXA key storage (server-side, simplified)
// 1. A unique Data Encryption Key (DEK) is generated per API key.
// 2. The provider key is encrypted with AES-256-GCM.
// 3. The DEK is wrapped by a master Key Encryption Key (KEK)
//    stored in a dedicated KMS / HSM.
// 4. Only the encrypted ciphertext and wrapped DEK are persisted.

const encrypted = aes256gcm.encrypt(providerKey, dek);
const wrappedDek = kms.wrapKey(dek);
await db.keys.insert({
  user_id: userId,
  ciphertext: encrypted.ciphertext,
  iv: encrypted.iv,
  tag: encrypted.tag,
  wrapped_dek: wrappedDek,
});