---
title: "List BYOK provider credentials"
method: GET
path: "/byok"
tags: ["BYOK"]
---

# List BYOK provider credentials

`GET /byok`

List the bring-your-own-key (BYOK) provider credentials for the authenticated entity's default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace, or the `provider` query parameter to filter by upstream provider. [Management key](/docs/guides/overview/auth/management-api-keys) required.

## Query parameters

- `offset` integer, nullable — Number of records to skip for pagination
- `limit` integer — Maximum number of records to return (max 100)
- `workspace_id` string, uuid — Optional workspace ID to filter by. When omitted, resolves to the account’s default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.
- `provider` 'ai21' | 'aion-labs' | 'akashml' | 'alibaba' | 'amazon-bedrock' | 'amazon-bedrock/claude-on-aws' | 'amazon-nova' | 'ambient' | 'anthropic' | 'anthropic/2' | 'arcee-ai' | 'assemblyai' | 'atlas-cloud' | 'avian' | 'azure' | 'baidu' | 'baseten' | 'black-forest-labs' | 'byteplus' | 'cerebras' | 'chutes' | 'cirrascale' | 'clarifai' | 'claude-on-aws' | 'cloudflare' | 'cohere' | 'coreweave' | 'cosine' | 'crusoe' | 'darkbloom' | 'databricks' | 'decart' | 'deepgram' | 'deepinfra' | 'deepseek' | 'dekallm' | 'digitalocean' | 'featherless' | 'fireworks' | 'fish-audio' | 'friendli' | 'gmicloud' | 'google-ai-studio' | 'google-vertex' | 'groq' | 'heygen' | 'inception' | 'inceptron' | 'inferact-vllm' | 'inference-net' | 'infermatic' | 'inflection' | 'io-net' | 'ionstream' | 'krea' | 'liquid' | 'makora' | 'mancer' | 'mara' | 'meta' | 'minimax' | 'mistral' | 'modal' | 'modelrun' | 'modular' | 'moonshotai' | 'morph' | 'near-ai' | 'nebius' | 'nex-agi' | 'nextbit' | 'novita' | 'nvidia' | 'ollama' | 'open-inference' | 'openai' | 'parasail' | 'perceptron' | 'perplexity' | 'phala' | 'poolside' | 'primeintellect' | 'quiver' | 'recraft' | 'reka' | 'relace' | 'runway' | 'sail-research' | 'sakana' | 'sakana-ai' | 'sambanova' | 'seed' | 'siliconflow' | 'sourceful' | 'stepfun' | 'streamlake' | 'switchpoint' | 'tencent' | 'tenstorrent' | 'thinkingmachines' | 'together' | 'typesafe' | 'unbiased' | 'upstage' | 'venice' | 'voyageai' | 'wafer' | 'wandb' | 'wandb-legacy' | 'xai' | 'xiaomi' | 'z-ai' — Optional provider slug to filter by (e.g. `openai`, `anthropic`, `amazon-bedrock`).

## Response `200`

List of BYOK credentials

- ListBYOKKeysResponse
  - `data` BYOKKey[], required — List of BYOK credentials.
    - `allowed_api_key_hashes` string[], nullable, required — Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction.
    - `allowed_models` string[], nullable, required — Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
    - `allowed_user_ids` string[], nullable, required — Optional allowlist of user IDs that may use this credential. `null` means no restriction.
    - `created_at` string, required — ISO timestamp of when the credential was created.
    - `disabled` boolean, required — Whether this credential is currently disabled.
    - `id` string, uuid, required — Stable public identifier for this BYOK credential.
    - `is_byok_only` boolean, required — Whether OpenRouter's shared endpoints on this provider are removed for every model, including models outside `allowed_models` and after all of your keys for the provider fail. The provider is skipped instead of spending OpenRouter credits. Only valid on non-fallback credentials.
    - `is_fallback` boolean, required — Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried. Cannot be combined with `is_byok_only`.
    - `is_required` boolean, required — Whether OpenRouter's shared endpoints on this provider are removed for the models this credential applies to (its `allowed_models`, or every model when `null`). Requests for those models run only on your keys; models outside the allowlist may still fall back to shared capacity on this provider.
    - `label` string, required — Short masked snippet of the key (e.g. the first/last few characters) used to identify it in the UI.
    - `name` string, nullable — Optional human-readable name for the credential.
    - `provider` 'ai21' | 'aion-labs' | 'akashml' | 'alibaba' | 'amazon-bedrock' | 'amazon-bedrock/claude-on-aws' | 'amazon-nova' | 'ambient' | 'anthropic' | 'anthropic/2' | 'arcee-ai' | 'assemblyai' | 'atlas-cloud' | 'avian' | 'azure' | 'baidu' | 'baseten' | 'black-forest-labs' | 'byteplus' | 'cerebras' | 'chutes' | 'cirrascale' | 'clarifai' | 'claude-on-aws' | 'cloudflare' | 'cohere' | 'coreweave' | 'cosine' | 'crusoe' | 'darkbloom' | 'databricks' | 'decart' | 'deepgram' | 'deepinfra' | 'deepseek' | 'dekallm' | 'digitalocean' | 'featherless' | 'fireworks' | 'fish-audio' | 'friendli' | 'gmicloud' | 'google-ai-studio' | 'google-vertex' | 'groq' | 'heygen' | 'inception' | 'inceptron' | 'inferact-vllm' | 'inference-net' | 'infermatic' | 'inflection' | 'io-net' | 'ionstream' | 'krea' | 'liquid' | 'makora' | 'mancer' | 'mara' | 'meta' | 'minimax' | 'mistral' | 'modal' | 'modelrun' | 'modular' | 'moonshotai' | 'morph' | 'near-ai' | 'nebius' | 'nex-agi' | 'nextbit' | 'novita' | 'nvidia' | 'ollama' | 'open-inference' | 'openai' | 'parasail' | 'perceptron' | 'perplexity' | 'phala' | 'poolside' | 'primeintellect' | 'quiver' | 'recraft' | 'reka' | 'relace' | 'runway' | 'sail-research' | 'sakana' | 'sakana-ai' | 'sambanova' | 'seed' | 'siliconflow' | 'sourceful' | 'stepfun' | 'streamlake' | 'switchpoint' | 'tencent' | 'tenstorrent' | 'thinkingmachines' | 'together' | 'typesafe' | 'unbiased' | 'upstage' | 'venice' | 'voyageai' | 'wafer' | 'wandb' | 'wandb-legacy' | 'xai' | 'xiaomi' | 'z-ai', required — The upstream provider this credential authenticates against, as a lowercase slug (e.g. `openai`, `anthropic`, `amazon-bedrock`).
    - `sort_order` integer, required — Position within the provider — credentials are tried in ascending sort order.
    - `workspace_id` string, uuid, nullable, required — The workspace this credential is scoped to, or `null` when it is global — usable across every workspace in the account. A `null` value does not mean the default workspace.
  - `total_count` integer, required — Total number of BYOK credentials matching the filters.

## Other responses

- `400` — Bad Request - Invalid request parameters or malformed input
- `401` — Unauthorized - Authentication required or invalid credentials
- `500` — Internal Server Error - Unexpected server error

## Changes

- **2026-09-17** `3066544509b5` — 1 warning, 1 info
  - added the new `unbiased` enum value to the `data/items/provider` response property for the response status `200`
  - added the new enum value `unbiased` to the `query` request parameter `provider`
- **2026-09-17** `2de027b6dfcd` — 1 warning, 1 info
  - added the new `typesafe` enum value to the `data/items/provider` response property for the response status `200`
  - added the new enum value `typesafe` to the `query` request parameter `provider`
- **2026-09-14** `54ab2e9ba857` — 1 warning, 1 info
  - added the new `assemblyai` enum value to the `data/items/provider` response property for the response status `200`
  - added the new enum value `assemblyai` to the `query` request parameter `provider`
- **2026-09-11** `34a00258bec9` — 3 warning, 3 info
  - added the new `amazon-bedrock/claude-on-aws` enum value to the `data/items/provider` response property for the response status `200`
  - added the new `anthropic/2` enum value to the `data/items/provider` response property for the response status `200`
  - added the new `claude-on-aws` enum value to the `data/items/provider` response property for the response status `200`
  - added the new enum value `amazon-bedrock/claude-on-aws` to the `query` request parameter `provider`
  - …2 more
- …earlier changes not shown

[Full history](https://skmtc.dev/openrouterteam/apis/openrouter-api/changes/byok/get.md)

---

[API](https://skmtc.dev/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.dev/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openrouterteam/apis/openrouter-api/revisions/1212b12392a8?raw)