BYOK — Bring your own provider keys

Use your existing provider keys with Ollima — including providers' free tiers. Provider charges (if any) go to your provider account; Ollima is the routing + observability layer. Available on all plans, including Free.

When to use BYOK

• You've negotiated a discount with a provider — your own key gives you that rate.
• You're under a provider's enterprise SLA — Ollima's routing layer would invalidate it.
• Your spend on one provider crossed ~$2-3K/mo and the platform fee on hosted billing exceeds the BYOK fee.
• You need provider-side observability (the provider's own dashboard / billing records) for compliance.

Supported providers

Direct-proxy mode works with any OpenAI-compatible provider: register your key on the Providers page and Ollima proxies your requests straight to that provider's OpenAI-shape endpoint, with zero intermediary — your key stays on the wire to the provider. Providers that use a different API shape are on the roadmap; track them on GitHub.

Free models via your own key

Several supported providers offer a free tier — bring that key and Ollima routes through it for free, giving you one interface, one usage dashboard, and per-key spend caps. The quota is yours (tied to your provider account), so it scales per developer instead of sharing a single pool.

Add a provider key

1. Open app.ollima.com → Providers. (Only visible on paid plans.)
2. Pick a provider, paste your key. The dashboard hits POST /orgs/<slug>/providers over your authenticated session — the plaintext key never goes to our backend except to be encrypted with ChaCha20-Poly1305 using a per-deployment master key.
3. You'll see a green dot next to that provider once a probe call succeeds.

Direct your traffic to BYOK

Once a provider key is registered, the shim auto-proxies any request whose resolved provider matches. You don't change your client code. Behavior summary:

• Request to model: "deepseek-v4" — if you have a BYOK key registered for the provider that alias resolves to, we direct-proxy with your key. Otherwise we use Ollima's hosted routing (counted against your hosted quota).
• Streaming, tool calling, embeddings — all work identically on the BYOK path.
• The response is byte-identical to what the provider returned, plus our standard X-Ollima-Request-Id header.

Rotate / revoke

From the Providers page: click Rotate, paste the new key, the old one is overwritten atomically. Click Revoke to delete the encrypted row — future requests fall back to Ollima-hosted billing on that provider.

How billing changes

BYOK requests:

• Do not count toward your monthly Ollima plan spend cap — the provider bills you directly.
• Do still count toward your plan's RPM cap (20/60/240 requests/min for Free/Pro/Enterprise — see Rate limits).
• On the Free plan, BYOK routing is free — bring a free-tier key and pay nothing to anyone. On paid plans, BYOK carries an Ollima platform fee of ₹0.10 per 1000 tokens of metered output, billed monthly via Razorpay alongside your subscription.
• Appear in Usage with provider name byok:<provider> so you can split-attribute spend.

Key storage & security

• At-rest: ChaCha20-Poly1305 AEAD with per-deployment master key. Master key lives only in env (OLLIMA_MASTER_KEY), never on disk in the container.
• In transit: TLS to the provider, no plaintext logging.
• Access: only the gateway process can decrypt. BFF + dashboard see only metadata (provider name, last-used timestamp, public probe status). DB admins see ciphertext only.
• Rotation: the master key can be rotated; on rotation we re-encrypt all rows in a single transaction. Provider keys themselves you rotate yourself, when you want.