Create BYOK key
import requests
url = "https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys"
payload = {
"provider": "<string>",
"api_key": "<string>",
"name": "<string>",
"is_default": True,
"account_tier": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
provider: '<string>',
api_key: '<string>',
name: '<string>',
is_default: true,
account_tier: '<string>'
})
};
fetch('https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request POST \
--url https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"provider": "<string>",
"api_key": "<string>",
"name": "<string>",
"is_default": true,
"account_tier": "<string>"
}
'{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"provider": "<string>",
"name": "<string>",
"key_prefix": "<string>",
"is_default": true,
"disabled": true,
"validation_status": "valid",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"account_tier": "<string>",
"account_tier_source": "auto_detected",
"last_validated_at": "2023-11-07T05:31:56Z",
"propagation_status": "pending"
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"provider": "<string>",
"name": "<string>",
"key_prefix": "<string>",
"is_default": true,
"disabled": true,
"validation_status": "valid",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"account_tier": "<string>",
"account_tier_source": "auto_detected",
"last_validated_at": "2023-11-07T05:31:56Z",
"propagation_status": "pending"
}{
"error": {
"message": "API key is invalid.",
"type": "authentication_error",
"param": null,
"code": "invalid_api_key"
}
}BYOK
Create BYOK key
Creates a BYOK key after validating the provider secret
POST
/
v1
/
workspaces
/
{workspace_id}
/
byok-keys
Create BYOK key
import requests
url = "https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys"
payload = {
"provider": "<string>",
"api_key": "<string>",
"name": "<string>",
"is_default": True,
"account_tier": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
provider: '<string>',
api_key: '<string>',
name: '<string>',
is_default: true,
account_tier: '<string>'
})
};
fetch('https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request POST \
--url https://api.auriko.ai/v1/workspaces/{workspace_id}/byok-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"provider": "<string>",
"api_key": "<string>",
"name": "<string>",
"is_default": true,
"account_tier": "<string>"
}
'{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"provider": "<string>",
"name": "<string>",
"key_prefix": "<string>",
"is_default": true,
"disabled": true,
"validation_status": "valid",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"account_tier": "<string>",
"account_tier_source": "auto_detected",
"last_validated_at": "2023-11-07T05:31:56Z",
"propagation_status": "pending"
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"workspace_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"provider": "<string>",
"name": "<string>",
"key_prefix": "<string>",
"is_default": true,
"disabled": true,
"validation_status": "valid",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"account_tier": "<string>",
"account_tier_source": "auto_detected",
"last_validated_at": "2023-11-07T05:31:56Z",
"propagation_status": "pending"
}{
"error": {
"message": "API key is invalid.",
"type": "authentication_error",
"param": null,
"code": "invalid_api_key"
}
}Auriko validates the submitted secret against the provider before activation.
Requires
To replace a secret, create a new key, set it as default, then delete the old one.
Validation outcomes: invalid credentials are rejected with
Auriko derives the key’s data policy from provider + tier.
All parameters, request/response schemas, and examples are auto-generated from the OpenAPI specification.
byok:write scope. Supports Idempotency-Key. Audit event: byok_key.created.
The provider secret is write-only: accepted once here, encrypted at rest, and never returned by any endpoint.
Idempotency-Key replays return the redacted metadata response only — never the secret.400 and nothing is saved; transient provider validation failures return a retryable 502 and nothing is saved. A 409 during an in-flight create with the same Idempotency-Key means the original request is still running. Wait and retry.
account_tier accepts the values from List Provider Account Tiers. When omitted, Auriko auto-detects the tier or falls back to the provider’s conservative default.May return
202 with propagation_status: "pending" while the change takes effect. Propagation completes within about 5 minutes.Authorizations
API key authentication.
Keys start with ak_ prefix.
Example: Authorization: Bearer ak_live_xxxxxxxxxxxx
Headers
Idempotency key for safe retries
Maximum string length:
255Pattern:
^[A-Za-z0-9_-]+$Path Parameters
Workspace identifier
Body
application/json
Provider identifier from GET /v1/byok/providers
Provider secret. Accepted once at creation, encrypted at rest, and never returned by any endpoint.
Minimum string length:
10Human-readable name (defaults to " Key")
Required string length:
1 - 100Whether this key becomes the provider's routing default
Provider account tier from the tiers endpoint. Omit to let Auriko auto-detect or use the provider's conservative default.
Response
Created
BYOK key metadata. Redacted — the provider secret is never returned.
Unique identifier for the BYOK key
Workspace this key belongs to
Provider identifier
Human-readable name for the key
Masked display prefix of the submitted secret
Whether this key is the provider's default for routing
Disabled keys are excluded from routing; the secret stays encrypted at rest
Coarse validation status (no provider diagnostics)
Available options:
valid, pending, invalid, error Provider account tier used for rate-limit and data-policy routing
How the tier was determined
Available options:
auto_detected, user_specified, fallback, null When the key last passed validation (null if never)
"pending" while a routing-affecting change for this key's provider is committed but edge propagation has not yet been applied
Available options:
pending, null