Privian
Get Started

BYOK — Bring your own provider key

Privian forwards masked prompts to providers using credentials you supply once and store in the dashboard, not in the request.

How it works

  1. Add a provider API key (OpenAI, Anthropic, Google, …) in the dashboard.
  2. Privian encrypts the key with AES-GCM using a master key + per-organisation version.
  3. On a request, the gateway resolves the provider from the model namespace (e.g. openai/gpt-5.5 → OpenAI), decrypts the relevant credential, and calls the provider.
  4. The plaintext key never leaves the server and never reaches the caller.

What is stored

  • Ciphertext + initialization vector + key version.
  • Last 4 characters of the key for identification in the UI.
  • Key fingerprint (hash) for deduplication and rotation visibility.
  • Status, label, timestamps.

What is not stored

  • The plaintext provider key.
  • Provider-side usage details beyond what Privian needs to route the request.

Rotation and revocation

Add a new credential, mark the old one revoked. Revoked credentials are no longer eligible for routing.

Related