BYOK lets you use your own API keys instead of MiraBridge's shared pool. You pay the provider directly, your requests stay on your own provider account, and you get full control over usage and quotas. MiraBridge supports BYOK across four managed providers plus an expanding set of additional providers reachable through the same gateway.
Why BYOK
- No platform token limits — you spend against your own provider quota
- Direct billing — pay the provider directly, often cheaper for heavy or specialized usage
- Privacy — requests route through your own API account, not the shared pool
- Choice — pick the model that fits the task, including providers MiraBridge does not run a managed key for
Managed providers
These four providers are also routable through MiraBridge's shared key (no BYOK required), but you can still supply your own key to bill the provider directly.
| Provider | Provider id | Key source | Notes |
| --- | --- | --- | --- |
| Anthropic | anthropic | console.anthropic.com | Claude Sonnet, Opus, Haiku. Tool calling native. |
| OpenAI | openai | platform.openai.com | GPT-5.x family. Default base URL https://api.openai.com/v1. Tool calling native. |
| Google Gemini | google | aistudio.google.com | Gemini 2.5 / 3.x families. Tool calling native. |
| GLM (ZhipuAI) | glm | open.bigmodel.cn | Default base URL https://open.bigmodel.cn/api/paas/v4. Tool calling supported. |
BYOK — single-field providers
Each provider below needs only an API key (and optionally a base URL override). All are reachable from Desktop, VS Code, and Mobile through the same gateway routing path. Tool calling support reflects what the provider's OpenAI-compatible surface advertises today — when in doubt, check the provider's own model docs.
| Provider | Provider id | Default base URL | Tool calling | Notes |
| --- | --- | --- | --- | --- |
| OpenRouter | openrouter | https://openrouter.ai/api/v1 | Yes (model-dependent) | Use model IDs like anthropic/claude-* or openai/gpt-*. MiraBridge sends the required HTTP-Referer and X-Title headers automatically. Per-request markup applies. |
| LiteLLM proxy | litellm | http://localhost:4000 (override required) | Yes (depends on backing model) | Self-hosted proxy in front of any provider. Base URL is required — point at your LiteLLM instance. |
| Ollama | ollama | http://localhost:11434/v1 | Limited (model-dependent) | Local OpenAI-compatible endpoint. Free at the provider; useful for offline / on-device models. |
| Mistral | mistral | https://api.mistral.ai/v1 | Yes | Mistral Large and Codestral families. Get a key from console.mistral.ai. |
| DeepSeek | deepseek | https://api.deepseek.com | Yes | Chat / coder / reasoner models. Cache-read discount applies to long sessions. |
| Qwen (DashScope) | qwen | https://dashscope-intl.aliyuncs.com/compatible-mode/v1 | Yes | Alibaba DashScope OpenAI-compatible endpoint. Switch base URL for the CN region if needed. |
| xAI Grok | grok | https://api.x.ai/v1 | Yes | API key prefix xai-. Live-search tool carries a separate per-request surcharge — see xAI pricing. |
| Together AI | together | https://api.together.xyz/v1 | Yes (model-dependent) | OpenAI-compatible serving for open-weight models. |
| Fireworks AI | fireworks | https://api.fireworks.ai/inference/v1 | Yes (model-dependent) | OpenAI-compatible serving for open-weight and fine-tuned models. |
| Groq | groq | https://api.groq.com/openai/v1 | Yes (model-dependent) | Low-latency LPU inference. No prompt cache discount today — assume cold cache pricing. |
| Cerebras | cerebras | https://api.cerebras.ai/v1 | Yes (model-dependent) | API key prefix csk-. Cerebras offers a free tier; paid tier varies by model. |
| Perplexity Sonar | perplexity | https://api.perplexity.ai | Limited | API key prefix pplx-. Search-augmented LLM; Sonar Pro carries a per-request search surcharge — see Perplexity pricing. |
| Hugging Face Router | hf-router | https://router.huggingface.co/v1 | Yes (provider-dependent) | API key prefix hf_. Routes to HF Inference Providers; the backing provider determines tool-call support. |
You can also point any OpenAI-compatible endpoint that isn't listed above through the generic openai-compatible provider id — vLLM, Text Generation Inference, or any custom proxy. The base URL is required in that case.
BYOK — multi-field providers (coming soon)
The following providers need more than a single API key — they require region, deployment id, account id, or per-endpoint URL. Their adapters ship in a later phase and require multi-field configuration in MiraBridge settings. They are not yet enabled in the default Desktop / VS Code / Mobile picker.
| Provider | Provider id | Required fields | Notes |
| --- | --- | --- | --- |
| Azure OpenAI | azure-openai | Resource name, deployment id, API version, API key | Mirrors OpenAI model surface; some regions carry an uplift. See your Azure portal. |
| AWS Bedrock | bedrock | Access key id, secret access key, region, optional session token | SigV4-signed. Per-model per-region pricing — no global rate; reference the AWS Bedrock console. |
| Cloudflare Workers AI | cloudflare-workers-ai | Account id, API token | Per-neuron pricing model. See Cloudflare Workers AI pricing for current neuron rates. |
| Hugging Face Inference Endpoints | hf-inference-endpoints | Endpoint URL, API token | Per-endpoint dedicated URL. Backing model determines tool-call support. |
These four providers will roll out behind a server-side feature flag with multi-field configuration UI in a follow-up release. The fields above are stored encrypted alongside the API key when that path lights up.
BYOK — full-custom provider
| Provider | Provider id | Default base URL | Tool calling | Notes |
| --- | --- | --- | --- | --- |
| Cohere | cohere | https://api.cohere.com | Yes (with citations + tool_plan) | Command A Plus / Command R+ families. Citations and the Cohere tool_plan field are preserved in responses, so RAG-style answers keep their source markers intact. |
Setting Up BYOK
- Open MiraBridge Settings → AI Providers in VS Code, the Desktop app, or the mobile app.
- Pick the provider from the list. The picker shows the provider id and any default base URL it ships with.
- Paste your API key. For single-field providers you can optionally override the base URL (for example, to point at a regional Mistral endpoint).
- Save. MiraBridge validates the key with a lightweight provider probe before storing it.
Once a key is stored, the provider's models become selectable in the model picker on every surface tied to the same MiraBridge account.
Security
API keys are encrypted with AES-256-GCM before being persisted and are never logged or exposed in transit. A key is decrypted only inside the gateway at the moment it is forwarded to the backing provider. Each key carries an audit trail covering store, rotate, soft-disable, and delete events. Keys are never shared between MiraBridge accounts.
If a provider returns repeated 401 / 403 responses, MiraBridge soft-disables the stored key and prompts you to update it in settings — the disabled key is not used for further calls until you replace or re-enable it.
Next Steps
- Supported Models — compare model capabilities across providers
- Plans & Pricing — understand MiraBridge billing