Your own vendor keys

You can give Zabio your own API key for any vendor it serves: Anthropic, OpenAI, Google, DeepSeek, xAI, Mistral AI or Together AI. Calls to that vendor then run on your key and are billed by the vendor to you, while you keep Zabio’s routing, sessions, stored conversations and dashboard.

Why

• You already have a vendor contract, committed spend or credits you want to use.
• You want the vendor’s invoice for that traffic, not Zabio’s.
• You want to use credits you already hold at a vendor: calls to named models on your own key need no Zabio credits.

Which vendors

Vendor	Key	Where to create it
anthropic	an Anthropic API key	the Anthropic Console
openai	an OpenAI API key	the OpenAI platform, API keys page
google	a Google AI Studio (Gemini API) key	Google AI Studio
deepseek	a DeepSeek API key	platform.deepseek.com/api_keys
xai	an xAI API key	console.x.ai, API Keys page
mistral	a Mistral AI API key	console.mistral.ai, API Keys in the sidebar
together	a Together AI API key	api.together.ai, your project’s API keys page

One active key per vendor per organization.

A key applies to every model Zabio serves through that vendor. A Together AI key therefore also serves the DeepSeek copies hosted in the United States (their ids end in @together). The DeepSeek models served by DeepSeek itself, which process data in China, need a DeepSeek key.

Adding a key

Billing page, vendor keys section, or:

zabio vendor-keys add --vendor anthropic --label "team key"

The CLI reads the key with hidden input. Zabio then:

1. verifies the key with one cheap authenticated call to the vendor (a model listing). A key the vendor rejects is not stored: you get vendor_key_invalid. If the vendor cannot be reached the request fails with vendor_unavailable and nothing is stored;
2. encrypts it with a data key unique to your organization (AES-256-GCM) and stores the ciphertext, the last four characters and the label;
3. starts using it for that vendor within a few seconds.

Only owners and admins can add or remove vendor keys. The plaintext is never shown again, never logged, and never returned by any API.

What changes on calls

• Responses served with your key carry zabio.byok: true and the header x-zabio-byok: true.
• Free except (see the pricing page) per auto call. Calls served with your own key pay no service fee and vendor_micros is 0, because Zabio has no provider cost; the vendor bills you directly. A call to a model you name on your key costs nothing through Zabio. An auto request served on your key pays only the fee for automatic model choice, the price of picking the model, once per request, shown as call_fee_micros. The response still carries direct_micros, what the call would have cost sent straight to the vendor, so the numbers stay comparable.
• No credits needed for a named model whose vendor you hold a key for. auto (any line, or a request with no model) runs on Zabio’s key whatever keys you hold, because the classifier does; at zero balance it is served under the Free terms like any other call (or refused with 402 insufficient_credits when the organization is set to stop). The same goes for a stored conversation that needs compaction: the summary is an auto/cheap call on Zabio’s key. A Free account can therefore start on its own keys with no top-up: named models on your keys are not locked and not counted toward the Free limits; auto is.
• Your key’s rate limits at the vendor apply to your traffic.

When the vendor rejects your key

If a vendor answers 401 or 403 to a call made with your key, Zabio marks the key invalid, answers your call with 400 byok_key_invalid, and stops using it. It never falls back to Zabio’s own key for that vendor, so you never pay Zabio for traffic you meant to run on your contract. Replace the key to resume.

Removing a key

Billing page, or zabio vendor-keys remove vk_.... The ciphertext is erased at once; the row stays without a usable secret for the audit trail. Processes that cached the key stop using it within five minutes. Calls to that vendor go back to Zabio’s keys and to your credits.

Listing

zabio vendor-keys list

Shows id, vendor, last four characters, status (active or invalid) and label. The web app also shows when the key was verified, last used, and the vendor’s reason when it was marked invalid.