Bring Your Own Key (BYOK)

Bring Your Own Key (BYOK) lets you use your own API keys when using the Kilo Gateway, while retaining Kilo platform features like Code Reviews and Cloud Agents.

A user or organization may want to use BYOK to:

• Utilize new models quickly, Kilo Gateway supports most new models in minutes
• Use subscriptions with third-party AI providers, for example the Z.ai Coding Plan, Kimi Code, or the BytePlus Coding Plan
• Attribute usage against existing provider commitments or agreements
• Use existing credits with a provider

Supported BYOK providers

Kilo Gateway supports BYOK keys for these providers.

Standard API keys

Use your provider API key to route matching models through your account:

• Anthropic
• AWS Bedrock
• Azure Foundry (experimental)
• DeepSeek
• Fireworks
• Google AI Studio
• Inception
• Minimax
• Mistral AI
• Moonshot AI (Kimi)
• Novita
• OpenAI
• Xiaomi
• SpaceXAI
• Z.ai

Subscription and direct provider plans

These providers offer coding-focused subscriptions or dedicated endpoints. Bring the API key issued by your plan to use its included models through the Kilo Gateway:

• BytePlus Coding Plan
• Chutes BYOK
• CrofAI
• Inceptron BYOK
• Kimi Code
• Martian
• Mistral Codestral
• Neuralwatt
• NVIDIA
• Ollama Cloud
• OpenCode Go
• OrcaRouter
• Synthetic
• Xiaomi Token Plan (Europe)
• Xiaomi Token Plan (Singapore)
• Z.ai Coding Plan

Add a BYOK key

1. Log into the Kilo platform and select the account or organization you want to add the BYOK key to.
2. Navigate to the Bring Your Own Key (BYOK) page, available in the sidebar under Account.
3. Click Add Your First Key, select the provider, and paste your API key.
4. Save.

AWS Bedrock configuration

AWS Bedrock requires JSON credentials. Use one of these two formats; don't mix fields from both.

Bedrock API key: Generate a key in the AWS Bedrock console and use a region where the key and model are available. Replace the key before it expires.

{
  "apiKey": "...",
  "region": "us-east-1"
}

IAM credentials:

{
  "accessKeyId": "AKIA...",
  "secretAccessKey": "...",
  "region": "us-east-1"
}

Your IAM user or role must have the following permissions:

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream

Azure Foundry configuration

Select Azure Foundry (experimental) and enter JSON credentials. Use resourceName for the subdomain of your endpoint, such as my-resource from my-resource.openai.azure.com:

{
  "apiKey": "...",
  "resourceName": "my-resource"
}

If your deployment names differ from the gateway model IDs, add modelMappings to map each model to its Azure deployment:

{
  "apiKey": "...",
  "resourceName": "my-resource",
  "modelMappings": [
    {
      "gatewayModelSlug": "openai/gpt-5.4-nano",
      "customModelId": "my-gpt-5-4-nano-deployment"
    }
  ]
}

How Bring Your Own Key works

• When you use the Kilo Gateway provider, Kilo checks if there's a BYOK key for the selected model's provider.
• If a matching BYOK key exists, the request is routed using your key.
• If the key is invalid, the request fails. It does not fall back to using Kilo's keys.
• Subscription-based providers (such as the Z.ai Coding Plan or Kimi Code) only expose the models included in that plan. Select one of those models to route traffic through your subscription.

Using BYOK in the Extensions and CLI

• BYOK works with the Kilo Gateway provider. Users should ensure that is set as the active provider.
• Kilo Gateway models that can use one of your enabled personal or organization BYOK providers display a BYOK badge in the model picker. The badge does not apply to models selected through other providers.
• Select a model with the BYOK badge, for example Claude Sonnet 4.5 if you configured BYOK for Anthropic, or GLM-4.7 if you configured the Z.ai Coding Plan.
• (Optional) Validate with the provider that traffic is being served by that key.