The markup problem
Most managed AI gateways monetize the same way: they hold the provider keys, pay the provider bill, and resell you the tokens at a markup, typically 10-20%, sometimes buried in per-request "platform fees." At small scale that's a convenience fee. At enterprise scale it's a structural tax: a team burning $40k/month in provider spend hands the gateway another $4-8k for the privilege of proxying its own traffic.
Worse, the markup model creates a perverse incentive: the gateway profits when you use more tokens, not when it saves you money. Caching and efficiency features sit in tension with the business model.
The enterprise ask is simple: "We already have negotiated OpenAI and Anthropic contracts. Why are we paying a second markup on top of them?"
The BYOK model
Bring-Your-Own-Key inverts the economics. You keep your direct provider relationships: your negotiated rates, your committed-use discounts, your existing billing. Sentinel charges a flat platform subscription for what it actually provides: routing, failover, caching, PII redaction, and observability. Zero token markup. Your provider bill goes to you, exactly as if you'd integrated directly.
- Transparent spend: provider invoices match your usage logs to the token
- Aligned incentives: our revenue doesn't grow when your token bill does
- Procurement-friendly: a flat SaaS line item instead of variable metered resale
Inside the Provider Key Vault
Today we're shipping the Provider Key Vault in the Command Center. Each tenant can register keys for OpenAI (sk-...), Anthropic (sk-ant-...), Google Gemini (AIza...), and Groq (gsk_...):
- Keys are stored encrypted at rest in the tenant-scoped vault, never logged, never returned in full by any API
- The dashboard shows masked values (
••••••••••••a1b2) with per-provider Test Connection and Remove controls - Format validation catches typos at entry time, before a bad key can poison routing
Per-request credential injection
The routing layer resolves credentials at request time. When your request targets claude-3-5-sonnet, the router checks your tenant's vault first: if an Anthropic key is registered, the request is signed with your key and billed by Anthropic directly to you. If no key is registered, the request falls back to Sentinel's managed credentials under your plan's token quota. One integration, two billing modes, zero code changes when you switch.
// Per-request key resolution
key := vault.Lookup(ctx, tenantID, provider) // tenant BYOK first
if key == "" {
key = managed.KeyFor(provider) // plan quota fallback
quota.TrackUsage(ctx, tenantID, tokens) // metered on managed path
}
// BYOK path: provider bills tenant directly, 0% markupSecurity boundary: BYOK tenants remain subject to their own provider agreements for API billing and acceptable use. Sentinel never takes custody of your provider relationship, only of the request pipeline. That boundary is spelled out in our Terms of Service.
Getting started
The vault is live for all tenants today. Open the Command Center, navigate to API Keys → Provider Key Vault (BYOK), paste a key, and hit Test Connection. Enterprise tier runs entirely on BYOK with unlimited traffic; Pro and Team tenants can mix managed quota and BYOK providers freely.