01 / Connect your provider
Validate access without overstating it.
OpenAI BYOK is free for now: OpenWaya charges no BYOK service fee and your provider bills you directly. Connect a named provider account with authorization attestation and recent step-up verification. Credential validation means checked provider authentication; it does not prove ownership or access to every model.
- Credentials are write-only and never returned in connection, audit, log, export, or support responses.
- Existing OpenWaya API keys remain managed-only until an authorized workspace user assigns a connection.
- Anthropic is represented for future compatibility but is not enabled or advertised.
02 / Migration
Opt in one key and request at a time.
After validation, assign the connection to an OpenWaya API key and narrow a request to that existing grant. A request cannot add a connection, change its tenant, or silently change who pays. Hybrid managed fallback remains unavailable until commercial, cap, and exactly-once accounting gates are approved.
{
"model": "YOUR_MODEL_ID",
"messages": [{"role": "user", "content": "Hello"}],
"openwaya": {
"byok": {
"allowed_connection_ids": ["YOUR_CONNECTION_ID"],
"funding_mode": "byok_only"
}
}
}03 / Funding and recovery
Keep payer and recovery decisions explicit.
OpenWaya charges and provider spend stay separate. The request log can show managed-only, BYOK-only, or hybrid funding mode plus the tenant's connection name. Provider cost is not invented when it is unknown, and local OpenWaya limits do not represent the provider account's complete budget.
- Rotate or revoke through the authenticated workspace Connections surface; no credential reveal is offered.
- A disabled or revoked connection blocks new admission without enabling managed fallback.
- Support diagnostics expose metadata and safe audit evidence only; they cannot run arbitrary customer-funded requests.