Bring Your Own Key
How BYOK works, supported providers, key storage architecture, and privacy guarantees.
What BYOK is
ekmire's semantic analyzer uses an LLM to score inbound requests. On the free tier, this uses ekmire's shared inference pool with a monthly limit. With BYOK, you supply your own API key from a supported provider — ekmire routes the call directly to your provider on your behalf, and your usage counts against your own account.
BYOK is available on all plans, including free. There is no price difference — you just supply the key.
Supported providers
| PROVIDER | HOW TO GET A KEY | NOTES |
|---|---|---|
| OpenAI | platform.openai.com/api-keys | GPT-4o recommended for semantic scoring. |
| Anthropic | console.anthropic.com/settings/keys | Claude 3.5 Haiku is fast and cost-effective for scoring. |
| Groq | console.groq.com/keys | Free tier available. Extremely low latency. Default on ekmire's shared pool. |
| Ollama | Self-hosted at http://localhost:11434 | No key needed. Set provider to Ollama and enter your endpoint URL. Fully air-gapped. |
How to configure
Go to Dashboard → Settings → LLM provider. Select your provider and enter your API key. The key is displayed as a masked string after saving.
End-to-end flow
When a request reaches the semantic analyzer stage:
- The proxy retrieves your stored key from the database (AES-256-GCM encrypted).
- The key is decrypted in memory only — the plaintext never touches disk.
- The proxy constructs the scoring request and forwards it to your provider with your key in the
Authorizationheader. - Your provider returns a response. The proxy extracts the score and discards the decrypted key and the prompt from memory.
- No prompt, no response, and no decrypted key are logged or stored anywhere in ekmire's infrastructure.
Key storage architecture
Your LLM key is encrypted with AES-256-GCM before writing to the database. The encryption master key lives in a server environment variable (ENCRYPTION_MASTER_KEY), never in the database itself. Each encryption operation uses a random 12-byte nonce, so identical keys produce different ciphertexts.
If the master key is compromised, all stored provider keys would need to be re-entered. This is intentional — there is no key-wrapping hierarchy to attack.
Privacy guarantees
ekmire never stores prompts or responses. Your provider's logs are the only place your content exists outside your control. ekmire also never stores the decrypted API key outside the memory of the process handling the request.
For users who require complete air-gapped operation (no outbound calls to LLM providers), configure Ollama with a local model. The proxy will call your local Ollama endpoint with no external network traffic.
Full data handling details: Privacy Policy.