AetherGate
Architecture Guide · Updated October 2026

BYOK LLM gateways: what bring-your-own-key actually changes

Bring Your Own Key sounds simple—paste an OpenAI or Anthropic key into a gateway—but it changes billing, custody, data flow and portability. Two gateways can both advertise BYOK while having very different fee policies and security models.

Key takeaways

  • BYOK should make provider billing and gateway billing separately visible.
  • Ask whether the gateway stores raw provider keys, encrypted keys, or requires sending provider credentials with every request.
  • Check for volume thresholds where a BYOK percentage fee begins.
  • Use scoped gateway keys for applications instead of distributing root provider credentials.

Provider billing and gateway billing are separate

With provider-direct BYOK, OpenAI, Anthropic, Google or another upstream provider charges your provider account for inference. The gateway may separately charge a subscription, request fee, percentage fee, log fee or infrastructure fee.

The clean comparison is total platform cost plus provider cost—not whether a landing page says “zero markup.” A zero-markup gateway can still have a meaningful subscription or usage charge, and a percentage-based gateway can be cheaper for a very small workload.

Key custody is the real security question

A production gateway should make it clear where upstream keys live and what your application sends. One pattern is an encrypted server-side provider vault: applications receive a scoped gateway credential while the upstream key stays inside the control plane.

Another pattern forwards or references provider keys per request. That can be simpler, but it increases the number of systems and request paths that handle root provider credentials.

  • Encryption at rest for stored provider keys.
  • No raw-key return to the browser after storage.
  • Scoped/revocable gateway credentials for applications.
  • Per-key rate and spend limits.
  • Clear deletion and rotation behavior.

BYOK and portability

BYOK reduces billing lock-in because your relationship with the model provider remains direct. It does not automatically eliminate gateway lock-in: routing rules, observability formats, virtual model aliases and agent workflows can still become platform-specific.

Prefer an OpenAI-compatible request surface and keep important routing configuration exportable. That makes a future migration less painful even if you never use it.

Related gateway comparisons

AetherGate vs OpenRouterAetherGate vs Orq.aiAetherGate vs RequestyAetherGate vs Vercel AI GatewayAetherGate vs LLM Gateway

Frequently asked questions

Does BYOK always mean zero gateway fees?

No. Some gateways charge no token markup, some charge a subscription, and others introduce percentage or request-based fees after an allowance. Read the pricing model separately from provider inference charges.

Is BYOK safer than one shared gateway credit balance?

It can improve provider-account ownership and portability, but safety depends on how the gateway stores and uses the keys. Encryption, scoped credentials, rotation and access controls matter more than the BYOK label itself.