Bring Your Own Keys (BYOK)

Mesh API supports both using Mesh API credits (platform credentials) and the option to bring your own provider keys (BYOK).

Using provider keys enables direct control over rate limits and costs via your provider account (e.g., AWS Bedrock, Google Vertex AI).

How it Works

When you configure a BYOK key, Mesh API securely stores the reference and uses it for requests routed through that provider on your behalf.

By default, requests will use your BYOK key. If your key fails (e.g., due to authentication errors or rate limits), the request will fall back to using Mesh API’s platform credentials, unless you have disabled fallback for that key.

Key Fallback

You can control the fallback behavior for each key:

• Fallback Enabled (Default): If your key fails or hits a rate limit, Mesh API will attempt to fulfill the request using shared platform credentials.
• Exclusive Use: You can disable fallback to ensure that requests for that provider ONLY use your key. If your key fails, the request will fail.

Platform Fee

The platform fee is currently 0% for all BYOK requests. You can use your own keys without any additional cost for now.

Supported Providers

BYOK is supported for the following providers. Here is what you need to configure each:

OpenAI

For OpenAI, you only need to provide your API key.

AWS Bedrock

You can configure Bedrock using one of two methods:

Method 1: Bedrock API Keys Simply provide your Bedrock API key as a string. Note that these keys are tied to a specific AWS region.

Method 2: AWS Credentials (JSON) Alternatively, you can provide a JSON object with your AWS IAM credentials and region:

1
{
2
  "accessKeyId": "your-aws-access-key-id",
3
  "secretAccessKey": "your-aws-secret-access-key",
4
  "region": "your-aws-region"
5
}

Ensure your IAM user or role has permissions for bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream.

Google Vertex AI

To use Vertex AI, you must provide your Google Cloud service account key in JSON format. The key should contain all standard fields, and you can optionally include a "region" field to specify the deployment region (defaults to "global" if omitted).

Example service account key with optional region:

1
{
2
  "type": "service_account",
3
  "project_id": "your-project-id",
4
  "private_key_id": "your-private-key-id",
5
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
6
  "client_email": "your-service-account@your-project.iam.gserviceaccount.com",
7
  "client_id": "your-client-id",
8
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
9
  "token_uri": "https://oauth2.googleapis.com/token",
10
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
11
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/your-service-account@your-project.iam.gserviceaccount.com",
12
  "universe_domain": "googleapis.com",
13
  "region": "global"
14
}

Ensure the service account has the Vertex AI User (roles/aiplatform.user) role or at least the aiplatform.endpoints.predict permission.

Debugging BYOK Issues

If your BYOK requests fail, you can debug the issue by checking the response or viewing logs. Common issues include:

• 401 Unauthorized: Your provider API key is invalid or revoked.
• 403 Forbidden: Your key lacks permissions for the requested model (e.g., AWS IAM policy missing bedrock:InvokeModel).
• 429 Too Many Requests: You have hit the rate limit on your provider account.