BYOK vs Marketplace
Keystore supports two modes for providing API credentials to your agents: BYOK (Bring Your Own Keys) and Marketplace (pre-provisioned keys). You can mix both modes within the same project.
BYOK (Bring Your Own Keys)
In BYOK mode, you add your own API keys from each provider. Keystore encrypts and stores them, then injects them into requests at proxy time.
How it works:
- You sign up with the provider (e.g., OpenAI) and generate an API key
- You add the key in the Keystore dashboard under Providers
- Keystore encrypts it with AES-256-GCM and stores the ciphertext
- When your agent makes a request, the proxy decrypts and injects your key
Best for:
- Teams with existing provider accounts and negotiated pricing
- Workloads that need specific account-level settings (organization IDs, custom rate limits)
- Full control over billing directly with the provider
Marketplace
In Marketplace mode, Keystore provides pre-provisioned API credentials. You do not need to create an account with the provider at all — just select the provider and start making requests.
How it works:
- You enable a provider from the Keystore marketplace
- Keystore provisions shared or dedicated credentials on your behalf
- Usage is billed through Keystore with transparent per-unit pricing
- No provider account or API key management required on your end
Best for:
- Rapid prototyping — start using a provider in seconds
- Agents that need access to many providers without managing dozens of accounts
- Teams that want consolidated billing across all providers
Comparison
| BYOK | Marketplace | |
|---|---|---|
| Setup time | Minutes (you create provider account + key) | Seconds (enable in dashboard) |
| API key management | You manage keys in the provider's dashboard | Keystore manages keys for you |
| Billing | Direct with provider | Through Keystore |
| Pricing | Your negotiated rate | Keystore per-unit pricing |
| Rate limits | Your account's limits | Shared or dedicated limits |
| Provider account required | Yes | No |
| Custom organization settings | Yes | No |
| Available providers | All supported providers | Select providers (see dashboard) |
Provider availability
Each provider in Keystore has an availability tier:
| Availability | Description | Examples |
|---|---|---|
| Marketplace | Available as pre-provisioned keys through the marketplace | OpenAI, Anthropic, Neon |
| Concierge | Available on request — contact support for provisioning | Twilio, Pinecone, Groq |
| Both | Available in both BYOK and Marketplace modes | OpenAI, Anthropic, Resend |
You can check provider availability on the Providers page in the dashboard.
Using both modes together
A single project can use BYOK for some providers and Marketplace for others. For example:
- BYOK for OpenAI (you have an enterprise agreement with custom pricing)
- Marketplace for Resend (you just need to send a few emails and do not want another account)
- BYOK for Neon (you have an existing database with production data)
The agent token works the same way regardless of mode. The proxy determines which credential to use based on the provider configuration in your project.
Switching modes
You can switch a provider from Marketplace to BYOK (or vice versa) at any time:
- Go to Providers in the dashboard
- Select the provider
- Choose BYOK and enter your own key, or choose Marketplace to use provisioned keys
Active agent tokens continue to work — the proxy picks up the new credential source automatically.
Next steps
- Agent Tokens — How tokens are scoped and secured
- How the Vault Works — The proxy architecture in detail