Bring your own provider keys
Use your own provider credentials with the hosted Relay.
Relay can use provider credentials that your organization stores in Speko. Configure them in the dashboard's BYOK page; you keep the same Relay endpoints and request shapes.
How credential selection works
A configured key takes precedence for that provider. If Relay selects a provider for which your organization has a key, the request uses that key. If the provider has no configured key, the request uses Speko-managed credentials.
Auto routing chooses a route first, then resolves the credential for the selected provider. You do not add a credential-source field to Relay requests.
Billing
- BYOK route: the provider bills your provider account directly. Speko does not charge provider usage for that attempt.
- Managed route: usage appears on your Speko invoice at the price frozen when the attempt starts.
Removing a provider key returns that provider to managed credentials for future requests.
Storage and access
Provider credentials are encrypted at rest. The Runtime control plane never decrypts them; only the regional provider connector handling an authorized request resolves and decrypts the selected credential.
Failover preserves the credential source
Automatic failover stays within the original credential-source set:
- a BYOK attempt can fall back only to another provider for which your organization has a configured key;
- a managed attempt can fall back only to a provider without an organization key;
- explicit routing never falls back.
If no healthy compatible route remains in the same set, the request returns a provider-unavailable error instead of silently changing who bills you.