BYOK / Passthrough

Use your own API keys to access frontier models (GPT-4o, Claude, Gemini) through DirectAI. All compliance features — guardrails, PII detection, audit logging — apply to passthrough requests.

How It Works

Passthrough models route requests to external provider APIs (OpenAI, Anthropic, Google) using your API key. DirectAI acts as a compliance proxy — enforcing guardrails, logging audit events, and detecting PII before the request leaves your boundary.

Client → DirectAI API Server
  → Guardrails (content safety, PII, injection)
  → Audit log
  → Forward to provider (OpenAI / Anthropic / Google)
  → Response guardrails
  → Audit log
  → Client

Adding Your Provider Key

Store your provider API key in the dashboard. Keys are encrypted with AES-256-GCM at rest and never logged.

  1. Go to Dashboard → API Keys
  2. Click "Add Provider Key"
  3. Select the provider (OpenAI, Anthropic, Google)
  4. Paste your provider API key
  5. DirectAI encrypts and stores it — you won't see it again

Making Requests

Use the same DirectAI API key and endpoint. Just specify a passthrough model name:

curl https://api.agilecloud.ai/v1/chat/completions \
  -H "Authorization: Bearer $DIRECTAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "messages": [
      {"role": "user", "content": "Explain HIPAA compliance."}
    ]
  }'

DirectAI resolves gpt-4o to the OpenAI passthrough config, retrieves your encrypted OpenAI key, and proxies the request.

Available Passthrough Models

Model AliasProviderRequired Key
gpt-4oOpenAIOpenAI API Key
gpt-4o-miniOpenAIOpenAI API Key
o3OpenAIOpenAI API Key
o3-miniOpenAIOpenAI API Key
claude-4-sonnetAnthropicAnthropic API Key
claude-3-5-sonnetAnthropicAnthropic API Key
gemini-2.0-flashGoogleGoogle AI API Key

Billing

DirectAI does not charge per-token for passthrough requests. You pay the provider directly. DirectAI's platform fee covers the compliance proxy, guardrails, and audit logging.

Security

  • Provider keys are encrypted at rest with AES-256-GCM
  • Keys are decrypted in-memory only for the duration of the request
  • Provider keys are never logged or included in audit records
  • You can delete your provider key at any time from the dashboard