Skip to main content
Pricing & Billing

BYOK: Bring Your Own Provider Key

Route through Relay for governance and audit with your own provider key — free below a generous monthly floor.

What BYOK means on Relay

You can supply your own provider API key (Anthropic, OpenAI, Google, etc.) and route requests through Relay instead of paying with Relay credit. Because Vibgrate incurs no provider cost on a BYOK request, it consumes no Relay credit and emits no billing meter events for the tokens themselves.

BYOK gets exactly the same context quality as the prepaid Relay lane. No capability is withheld from the CLI to make the hosted paid path look better — the CLI is open source, so a deliberate downgrade would show up in a diff.

Why route BYOK through Relay at all

If Relay costs you nothing extra on your own key, the value is everything around the token: your org's model allowlist, spend visibility, audit trail, and centralized governance apply the same way whether Vibgrate or you are the one holding the provider key. Usage is recorded in full either way — provider list cost is tracked even for BYOK requests, because it's what makes the platform fee threshold below measurable.

The BYOK platform fee

Heavy BYOK traffic still consumes Relay's routing, governance, audit, and support infrastructure, so a platform fee applies above a generous monthly floor:

PlanFree belowFee above the floor
Pay-as-you-go$30,000 / month4%
Enterprise$250,000 / month4%

The fee is marginal — 4% of spend above the threshold, never of the whole month. A workspace at $31,000 in a month pays 4% of the $1,000 over the floor, not 4% of $31,000; there is no cliff at the threshold. Spend is measured as the provider's own list cost of tokens routed on your key.

Setting up BYOK

Configure your provider key the same way you would for any other hosted provider in VG Code (--provider openai, --provider openrouter, etc. with the relevant *_API_KEY environment variable) — the key never touches Relay's credit ledger, and provider keys are held in an encrypted vault and resolved per request, never logged.

Related Documentation