---
title: "List BYOK provider credentials"
method: GET
path: "/byok"
tags: ["BYOK"]
---

# List BYOK provider credentials

`GET /byok`

List the bring-your-own-key (BYOK) provider credentials for the authenticated entity's default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace, or the `provider` query parameter to filter by upstream provider. [Management key](/docs/guides/overview/auth/management-api-keys) required.

## Query parameters

- `offset` integer, nullable — Number of records to skip for pagination
- `limit` integer — Maximum number of records to return (max 100)
- `workspace_id` string, uuid — Optional workspace ID to filter by. When omitted, resolves to the account’s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.
- `provider` 'ai21' | 'aion-labs' | 'akashml' | 'alibaba' | 'amazon-bedrock' | 'amazon-nova' | 'ambient' | 'anthropic' | 'arcee-ai' | 'atlas-cloud' | 'avian' | 'azure' | 'baidu' | 'baseten' | 'black-forest-labs' | 'byteplus' | 'cerebras' | 'chutes' | 'cirrascale' | 'clarifai' | 'cloudflare' | 'cohere' | 'coreweave' | 'crusoe' | 'darkbloom' | 'decart' | 'deepgram' | 'deepinfra' | 'deepseek' | 'dekallm' | 'digitalocean' | 'featherless' | 'fireworks' | 'fish-audio' | 'friendli' | 'gmicloud' | 'google-ai-studio' | 'google-vertex' | 'groq' | 'heygen' | 'inception' | 'inceptron' | 'inferact-vllm' | 'inference-net' | 'infermatic' | 'inflection' | 'io-net' | 'ionstream' | 'krea' | 'liquid' | 'mancer' | 'mara' | 'meta' | 'minimax' | 'mistral' | 'modal' | 'modelrun' | 'modular' | 'moonshotai' | 'morph' | 'ncompass' | 'nebius' | 'nex-agi' | 'nextbit' | 'novita' | 'nvidia' | 'open-inference' | 'openai' | 'parasail' | 'perceptron' | 'perplexity' | 'phala' | 'poolside' | 'quiver' | 'recraft' | 'reka' | 'relace' | 'runway' | 'sail-research' | 'sakana' | 'sakana-ai' | 'sambanova' | 'seed' | 'siliconflow' | 'sourceful' | 'stepfun' | 'streamlake' | 'switchpoint' | 'tencent' | 'tenstorrent' | 'thinkingmachines' | 'together' | 'upstage' | 'venice' | 'wafer' | 'wandb' | 'wandb-legacy' | 'xai' | 'xiaomi' | 'z-ai' — Optional provider slug to filter by (e.g. `openai`, `anthropic`, `amazon-bedrock`).

## Response `200`

List of BYOK credentials

- ListBYOKKeysResponse
  - `data` BYOKKey[], required — List of BYOK credentials.
    - `allowed_api_key_hashes` string[], nullable, required — Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction.
    - `allowed_models` string[], nullable, required — Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
    - `allowed_user_ids` string[], nullable, required — Optional allowlist of user IDs that may use this credential. `null` means no restriction.
    - `created_at` string, required — ISO timestamp of when the credential was created.
    - `disabled` boolean, required — Whether this credential is currently disabled.
    - `id` string, uuid, required — Stable public identifier for this BYOK credential.
    - `is_fallback` boolean, required — Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
    - `label` string, required — Short masked snippet of the key (e.g. the first/last few characters) used to identify it in the UI.
    - `name` string, nullable — Optional human-readable name for the credential.
    - `provider` 'ai21' | 'aion-labs' | 'akashml' | 'alibaba' | 'amazon-bedrock' | 'amazon-nova' | 'ambient' | 'anthropic' | 'arcee-ai' | 'atlas-cloud' | 'avian' | 'azure' | 'baidu' | 'baseten' | 'black-forest-labs' | 'byteplus' | 'cerebras' | 'chutes' | 'cirrascale' | 'clarifai' | 'cloudflare' | 'cohere' | 'coreweave' | 'crusoe' | 'darkbloom' | 'decart' | 'deepgram' | 'deepinfra' | 'deepseek' | 'dekallm' | 'digitalocean' | 'featherless' | 'fireworks' | 'fish-audio' | 'friendli' | 'gmicloud' | 'google-ai-studio' | 'google-vertex' | 'groq' | 'heygen' | 'inception' | 'inceptron' | 'inferact-vllm' | 'inference-net' | 'infermatic' | 'inflection' | 'io-net' | 'ionstream' | 'krea' | 'liquid' | 'mancer' | 'mara' | 'meta' | 'minimax' | 'mistral' | 'modal' | 'modelrun' | 'modular' | 'moonshotai' | 'morph' | 'ncompass' | 'nebius' | 'nex-agi' | 'nextbit' | 'novita' | 'nvidia' | 'open-inference' | 'openai' | 'parasail' | 'perceptron' | 'perplexity' | 'phala' | 'poolside' | 'quiver' | 'recraft' | 'reka' | 'relace' | 'runway' | 'sail-research' | 'sakana' | 'sakana-ai' | 'sambanova' | 'seed' | 'siliconflow' | 'sourceful' | 'stepfun' | 'streamlake' | 'switchpoint' | 'tencent' | 'tenstorrent' | 'thinkingmachines' | 'together' | 'upstage' | 'venice' | 'wafer' | 'wandb' | 'wandb-legacy' | 'xai' | 'xiaomi' | 'z-ai', required — The upstream provider this credential authenticates against, as a lowercase slug (e.g. `openai`, `anthropic`, `amazon-bedrock`).
    - `sort_order` integer, required — Position within the provider — credentials are tried in ascending sort order.
    - `workspace_id` string, uuid, nullable, required — The workspace this credential is scoped to, or `null` when it is global — usable across every workspace in the account. A `null` value does not mean the default workspace.
  - `total_count` integer, required — Total number of BYOK credentials matching the filters.

## Other responses

- `400` — Bad Request - Invalid request parameters or malformed input
- `401` — Unauthorized - Authentication required or invalid credentials
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.net/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openrouterteam/openrouter-api/versions/9d1da2c7d2c3/schema)