> ## Documentation Index > Fetch the complete documentation index at: https://openrouter.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update a BYOK provider credential > Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). A workspace-scoped management key only reaches credentials in its own workspace; any other `id` returns 404. [Management key](/docs/guides/overview/auth/management-api-keys) required. ## OpenAPI ````yaml /openapi/openapi.yaml patch /byok/{id} openapi: 3.1.0 info: contact: email: support@openrouter.ai name: OpenRouter Support url: https://openrouter.ai/docs description: OpenAI-compatible API with additional OpenRouter features license: name: MIT url: https://opensource.org/licenses/MIT title: OpenRouter API version: 1.0.0 servers: - description: Production server url: https://openrouter.ai/api/v1 x-speakeasy-server-id: production security: - apiKey: [] tags: - description: API key management endpoints name: API Keys - description: Analytics and usage endpoints name: Analytics - description: Anthropic Messages endpoints name: Anthropic Messages - description: BYOK endpoints name: BYOK - description: >- Submit, list, poll, and delete asynchronous batches of inference requests. See https://openrouter.ai/docs/batch-quickstart. name: Batch - description: Benchmarks endpoints name: Benchmarks - description: Chat completion endpoints name: Chat - description: Task classification market-share endpoints name: Classifications - description: Containers endpoints name: Containers - description: Credit management endpoints name: Credits - description: >- Public OpenRouter usage datasets. Data returned by these endpoints is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/): reuse and republish it, including commercially, with attribution to OpenRouter. name: Datasets - description: Text embedding endpoints name: Embeddings - description: Endpoint information name: Endpoints - description: External Users endpoints name: External Users - description: Files endpoints name: Files - description: Generation history endpoints name: Generations - description: Guardrail Policies endpoints name: Guardrail Policies - description: Guardrails endpoints name: Guardrails - description: Images endpoints name: Images - description: Model information endpoints name: Models - description: OAuth authentication endpoints name: OAuth - description: Observability endpoints name: Observability - description: Organization endpoints name: Organization - description: Presets endpoints name: Presets - description: Private Endpoints endpoints name: Private Endpoints - description: Private Providers endpoints name: Private Providers - description: Provider information endpoints name: Providers - description: Rerank endpoints name: Rerank - description: OpenAI-compatible Responses API endpoints name: Responses - description: >- Management endpoints for SCIM group-to-workspace mappings, authenticated with a management key. These are not the SCIM 2.0 connector endpoints for your identity provider. In your identity provider, enter the SCIM endpoint URL shown when you enable provisioning under Settings > Members > SCIM Mappings. See https://openrouter.ai/docs/guides/features/scim-mappings#set-up-provisioning. name: SCIM - description: Speech-to-text endpoints name: STT x-displayName: Transcriptions - description: >- System One endpoints for models such as Jev, compatible with the TypeSafe SDKs. See https://openrouter.ai/docs/guides/community/typesafe-sdk. name: SystemOne x-displayName: System One - description: Text-to-speech endpoints name: TTS x-displayName: Speech - description: >- The catalog of server tools OpenRouter runs on behalf of a model: accepted `tools[].type` spellings per API format, engines and pricing, and which endpoints run each tool natively. See https://openrouter.ai/docs/guides/features/server-tools. name: Tools - description: >- Store host-bound secrets for a workspace or for one intern. Scope is selected by the API key. Responses return metadata only, never secret values. See https://openrouter.ai/docs/guides/ori/vault. name: Vault - description: Video Generation endpoints name: Video Generation - description: Workspaces endpoints name: Workspaces - description: Alpha feature endpoints for Decisions requests name: alpha.decisions - description: Alpha feature endpoints for Extractions requests name: alpha.extractions externalDocs: description: OpenRouter Documentation url: https://openrouter.ai/docs paths: /byok/{id}: patch: tags: - BYOK summary: Update a BYOK provider credential description: >- Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). A workspace-scoped management key only reaches credentials in its own workspace; any other `id` returns 404. [Management key](/docs/guides/overview/auth/management-api-keys) required. operationId: updateBYOKKey parameters: - description: The BYOK credential ID (UUID). in: path name: id required: true schema: description: The BYOK credential ID (UUID). example: 11111111-2222-3333-4444-555555555555 format: uuid type: string requestBody: content: application/json: example: disabled: false name: Updated OpenAI Key schema: $ref: '#/components/schemas/UpdateBYOKKeyRequest' required: true responses: '200': content: application/json: example: data: allowed_api_key_hashes: null allowed_models: null allowed_user_ids: null created_at: '2025-08-24T10:30:00Z' declared_region: null declared_zdr: null disabled: false id: 11111111-2222-3333-4444-555555555555 is_byok_only: false is_fallback: false is_required: false label: sk-...AbCd name: Updated OpenAI Key provider: openai sort_order: 0 workspace_id: 550e8400-e29b-41d4-a716-446655440000 schema: $ref: '#/components/schemas/UpdateBYOKKeyResponse' description: BYOK credential updated successfully '400': content: application/json: example: error: code: 400 message: Invalid request parameters schema: $ref: '#/components/schemas/BadRequestResponse' description: Bad Request - Invalid request parameters or malformed input '401': content: application/json: example: error: code: 401 message: Missing Authentication header schema: $ref: '#/components/schemas/UnauthorizedResponse' description: Unauthorized - Authentication required or invalid credentials '403': content: application/json: example: error: code: 403 message: Only management keys can perform this operation schema: $ref: '#/components/schemas/ForbiddenResponse' description: Forbidden - Authentication successful but insufficient permissions '404': content: application/json: example: error: code: 404 message: Resource not found schema: $ref: '#/components/schemas/NotFoundResponse' description: Not Found - Resource does not exist '409': content: application/json: example: error: code: 409 message: Resource conflict. Please try again later. schema: $ref: '#/components/schemas/ConflictResponse' description: Conflict - Resource conflict or concurrent modification '500': content: application/json: example: error: code: 500 message: Internal Server Error schema: $ref: '#/components/schemas/InternalServerResponse' description: Internal Server Error - Unexpected server error components: schemas: UpdateBYOKKeyRequest: example: disabled: false name: Updated OpenAI Key properties: allowed_api_key_hashes: description: >- Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` clears the restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400; for a credential pinned to a workspace, so do hashes of API keys outside that workspace, unless the credential already lists them (a listed key that has since moved to another workspace stays listed and can be written back). example: - f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943 items: pattern: ^[a-f0-9]{64}$ type: string maxItems: 100 minItems: 1 type: - array - 'null' allowed_models: description: >- Optional allowlist of model slugs this credential may be used for. `null` means no restriction. example: null items: type: string maxItems: 100 type: - array - 'null' allowed_user_ids: description: >- Optional allowlist of user IDs that may use this credential. `null` means no restriction. example: null items: type: string maxItems: 100 type: - array - 'null' declared_region: description: >- Your declaration of the data region in which the upstream provider account behind this credential processes requests, used for routing eligibility on OpenRouter's regional hosts. `null` means undeclared and `global` is behaviorally identical: the credential follows the region OpenRouter records for the endpoint. `europe` or `us` lets requests to `eu.openrouter.ai` or `us.openrouter.ai` use this credential for that provider (private endpoints, endpoints pinned to another cloud region, cross-region inference profiles and video models are excluded). Self-declared and not verified by OpenRouter. For OpenAI and Fireworks the region comes from the key material (a `{"api_key": ..., "region": ...}` key), so the value must match the key's region. Among other providers, Azure accepts `europe` or `us` and Anthropic accepts `us` only. Omit to leave the stored value unchanged (rotating an OpenAI or Fireworks `key` re-derives it from the new key); `null` clears the declaration. enum: - global - europe - us - null example: null type: - string - 'null' declared_zdr: description: >- Your declaration of whether the upstream provider account behind this credential has zero data retention (ZDR). `null` inherits OpenRouter's data policy for the provider's endpoint; `true` declares the account ZDR so requests that require ZDR may route to this credential even when the shared endpoint retains data; `false` declares it non-ZDR so such requests never route to it. Self-declared and not verified by OpenRouter. Omit to leave the stored value unchanged; `null` clears the declaration. example: null type: - boolean - 'null' disabled: description: Whether this credential is disabled. example: false type: boolean is_byok_only: description: >- Whether OpenRouter's shared endpoints on this provider are removed for every model, including models outside `allowed_models` and after all of your keys for the provider fail. The provider is skipped instead of spending OpenRouter credits. Only valid on non-fallback credentials. Omit to leave the stored value unchanged. example: false type: boolean is_fallback: description: >- Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried. Cannot be combined with `is_byok_only`. Omit to leave the stored value unchanged. example: false type: boolean is_required: description: >- Whether OpenRouter's shared endpoints on this provider are removed for the models this credential applies to (its `allowed_models`, or every model when `null`). Requests for those models run only on your keys; models outside the allowlist may still fall back to shared capacity on this provider. Omit to leave the stored value unchanged. example: false type: boolean key: description: >- A new raw provider API key to rotate the credential in-place. The previous key material is overwritten and the masked label is regenerated. Encrypted at rest and never returned in API responses. example: sk-proj-newkey456... minLength: 1 type: string name: description: Optional human-readable name for the credential. example: Updated OpenAI Key maxLength: 255 type: - string - 'null' type: object UpdateBYOKKeyResponse: example: data: allowed_api_key_hashes: null allowed_models: null allowed_user_ids: null created_at: '2025-08-24T10:30:00Z' declared_region: null declared_zdr: null disabled: false id: 11111111-2222-3333-4444-555555555555 is_byok_only: false is_fallback: false is_required: false label: sk-...AbCd name: Updated OpenAI Key provider: openai sort_order: 0 workspace_id: 550e8400-e29b-41d4-a716-446655440000 properties: data: allOf: - $ref: '#/components/schemas/BYOKKey' - description: The updated BYOK credential. required: - data type: object BadRequestResponse: description: Bad Request - Invalid request parameters or malformed input example: error: code: 400 message: Invalid request parameters properties: error: $ref: '#/components/schemas/BadRequestResponseErrorData' openrouter_metadata: additionalProperties: {} type: - object - 'null' user_id: type: - string - 'null' required: - error type: object UnauthorizedResponse: description: Unauthorized - Authentication required or invalid credentials example: error: code: 401 message: Missing Authentication header properties: error: $ref: '#/components/schemas/UnauthorizedResponseErrorData' openrouter_metadata: additionalProperties: {} type: - object - 'null' user_id: type: - string - 'null' required: - error type: object ForbiddenResponse: description: Forbidden - Authentication successful but insufficient permissions example: error: code: 403 message: Only management keys can perform this operation properties: error: $ref: '#/components/schemas/ForbiddenResponseErrorData' openrouter_metadata: additionalProperties: {} type: - object - 'null' user_id: type: - string - 'null' required: - error type: object NotFoundResponse: description: Not Found - Resource does not exist example: error: code: 404 message: Resource not found properties: error: $ref: '#/components/schemas/NotFoundResponseErrorData' openrouter_metadata: additionalProperties: {} type: - object - 'null' user_id: type: - string - 'null' required: - error type: object ConflictResponse: description: Conflict - Resource conflict or concurrent modification example: error: code: 409 message: Resource conflict. Please try again later. properties: error: $ref: '#/components/schemas/ConflictResponseErrorData' openrouter_metadata: additionalProperties: {} type: - object - 'null' user_id: type: - string - 'null' required: - error type: object InternalServerResponse: description: Internal Server Error - Unexpected server error example: error: code: 500 message: Internal Server Error properties: error: $ref: '#/components/schemas/InternalServerResponseErrorData' openrouter_metadata: additionalProperties: {} type: - object - 'null' user_id: type: - string - 'null' required: - error type: object BYOKKey: example: allowed_api_key_hashes: null allowed_models: null allowed_user_ids: null created_at: '2025-08-24T10:30:00Z' declared_region: null declared_zdr: null disabled: false id: 11111111-2222-3333-4444-555555555555 is_byok_only: false is_fallback: false is_required: false label: sk-...AbCd name: Production OpenAI Key provider: openai sort_order: 0 workspace_id: 550e8400-e29b-41d4-a716-446655440000 properties: allowed_api_key_hashes: description: >- Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. Keys newly added to a credential pinned to a workspace must be in that workspace; a listed key that has since moved to another workspace stays listed. example: - f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943 items: type: string maxItems: 100 type: - array - 'null' allowed_models: description: >- Optional allowlist of model slugs this credential may be used for. `null` means no restriction. example: null items: type: string maxItems: 100 type: - array - 'null' allowed_user_ids: description: >- Optional allowlist of user IDs that may use this credential. `null` means no restriction. example: null items: type: string maxItems: 100 type: - array - 'null' created_at: description: ISO timestamp of when the credential was created. example: '2025-08-24T10:30:00Z' type: string declared_region: description: >- Your declaration of the data region in which the upstream provider account behind this credential processes requests, used for routing eligibility on OpenRouter's regional hosts. `null` means undeclared and `global` is behaviorally identical: the credential follows the region OpenRouter records for the endpoint. `europe` or `us` lets requests to `eu.openrouter.ai` or `us.openrouter.ai` use this credential for that provider (private endpoints, endpoints pinned to another cloud region, cross-region inference profiles and video models are excluded). Self-declared and not verified by OpenRouter. For OpenAI and Fireworks the region comes from the key material (a `{"api_key": ..., "region": ...}` key), so the value must match the key's region. Among other providers, Azure accepts `europe` or `us` and Anthropic accepts `us` only. enum: - global - europe - us - null example: null type: - string - 'null' declared_zdr: description: >- Your declaration of whether the upstream provider account behind this credential has zero data retention (ZDR). `null` inherits OpenRouter's data policy for the provider's endpoint; `true` declares the account ZDR so requests that require ZDR may route to this credential even when the shared endpoint retains data; `false` declares it non-ZDR so such requests never route to it. Self-declared and not verified by OpenRouter. example: null type: - boolean - 'null' disabled: description: Whether this credential is currently disabled. example: false type: boolean id: description: Stable public identifier for this BYOK credential. example: 11111111-2222-3333-4444-555555555555 format: uuid type: string is_byok_only: description: >- Whether OpenRouter's shared endpoints on this provider are removed for every model, including models outside `allowed_models` and after all of your keys for the provider fail. The provider is skipped instead of spending OpenRouter credits. Only valid on non-fallback credentials. example: false type: boolean is_fallback: description: >- Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried. Cannot be combined with `is_byok_only`. example: false type: boolean is_required: description: >- Whether OpenRouter's shared endpoints on this provider are removed for the models this credential applies to (its `allowed_models`, or every model when `null`). Requests for those models run only on your keys; models outside the allowlist may still fall back to shared capacity on this provider. example: false type: boolean label: description: >- Short masked snippet of the key (e.g. the first/last few characters) used to identify it in the UI. example: sk-...AbCd type: string name: description: Optional human-readable name for the credential. example: Production OpenAI Key type: - string - 'null' provider: $ref: '#/components/schemas/BYOKProviderSlug' sort_order: description: >- Position within the provider — credentials are tried in ascending sort order. example: 0 type: integer workspace_id: description: >- The workspace this credential is scoped to, or `null` when it is global — usable across every workspace in the account. A `null` value does not mean the default workspace. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: - string - 'null' required: - id - provider - workspace_id - label - disabled - is_fallback - is_required - is_byok_only - declared_zdr - declared_region - allowed_models - allowed_api_key_hashes - allowed_user_ids - sort_order - created_at type: object BadRequestResponseErrorData: description: Error data for BadRequestResponse example: code: 400 message: Invalid request parameters properties: code: type: integer message: type: string metadata: additionalProperties: {} type: - object - 'null' required: - code - message type: object UnauthorizedResponseErrorData: description: Error data for UnauthorizedResponse example: code: 401 message: Missing Authentication header properties: code: type: integer message: type: string metadata: additionalProperties: {} type: - object - 'null' required: - code - message type: object ForbiddenResponseErrorData: description: Error data for ForbiddenResponse example: code: 403 message: Only management keys can perform this operation properties: code: type: integer message: type: string metadata: additionalProperties: {} type: - object - 'null' required: - code - message type: object NotFoundResponseErrorData: description: Error data for NotFoundResponse example: code: 404 message: Resource not found properties: code: type: integer message: type: string metadata: additionalProperties: {} type: - object - 'null' required: - code - message type: object ConflictResponseErrorData: description: Error data for ConflictResponse example: code: 409 message: Resource conflict. Please try again later. properties: code: type: integer message: type: string metadata: additionalProperties: {} type: - object - 'null' required: - code - message type: object InternalServerResponseErrorData: description: Error data for InternalServerResponse example: code: 500 message: Internal Server Error properties: code: type: integer message: type: string metadata: additionalProperties: {} type: - object - 'null' required: - code - message type: object BYOKProviderSlug: description: >- The upstream provider this credential authenticates against, as a lowercase slug (e.g. `openai`, `anthropic`, `amazon-bedrock`). enum: - ai21 - aion-labs - akashml - alibaba - amazon-bedrock - amazon-bedrock/claude-on-aws - amazon-nova - ambient - antdigital - anthropic - anthropic/2 - arcee-ai - assemblyai - atlas-cloud - avian - azure - baidu - baseten - black-forest-labs - byteplus - cerebras - chutes - cirrascale - clarifai - claude-on-aws - cloudflare - cohere - coreweave - cosine - crusoe - darkbloom - databricks - decart - deepgram - deepinfra - deepseek - dekallm - digitalocean - elevenlabs - featherless - fireworks - fish-audio - friendli - gmicloud - google-ai-studio - google-vertex - groq - heygen - inception - inceptron - inferact-vllm - inference-net - infermatic - inflection - io-net - ionstream - krea - kt - liquid - makora - mancer - mara - meta - minimax - mistral - modal - modelrun - modular - moonshotai - morph - near-ai - nebius - nex-agi - nextbit - novita - nvidia - ollama - open-inference - openai - parallel - parasail - pareto-alpha - particle-ai - pearl-research - perceptron - perplexity - phala - poolside - primalabs - primeintellect - quiver - recraft - recursive - reka - relace - respan - river - runway - sail-research - sakana - sakana-ai - sambanova - scaledown - seed - siliconflow - sourceful - speechify - stepfun - streamlake - switchpoint - tencent - tenstorrent - thinkingmachines - together - typesafe - unbiased - upstage - venice - voyageai - wafer - wandb - wandb-legacy - xai - xiaomi - z-ai example: openai type: string securitySchemes: apiKey: description: API key as bearer token in Authorization header scheme: bearer type: http ````