The decision you are actually making is not whether to use a gateway; it is whose credentials the requests carry. Either you spend through the gateway’s pooled credits, or you attach your own provider keys and route your traffic over them. OrcaRouter names that second path on its BYOK page with a five-word summary — “Your provider contract. Our gateway.” [OURS, read 2026-10-15] — and the practical question is what your own key loses and keeps when it joins someone else’s router.
The honest answer has three parts: your key stays a first-class member of the routing pool, your key is never shown to the gateway’s clients after creation, and — the part that gets skipped in most comparisons — you inherit that provider’s rate limits, because the contract relationship stays yours. All three are printed on the BYOK page, and this article walks each one.
First concern: will the pool crowd out your key?
The first worry teams raise is that a bring-your-own key will be treated as second-class — a fallback that only gets traffic when the gateway’s own credits are busy. The page answers that directly: BYOK keys join the same routing pool, so automatic failover can still reach them [OURS, read 2026-10-15]. The BYOK key is a first-class member of the routing pool, not a placeholder that gets visited only when nothing else is available [OURS].
The reason that sentence is checkable is what it implies about the failover chain. If a BYOK key were cosmetic, a failover would skip it or route to it only in a degraded mode. First-class membership means the chain genuinely lands on your key — your committed spend, your negotiated rates, and your rate limits stay exactly where your contract put them, and the invoice relationship stays yours [OURS]. “We are the gateway, not the reseller” [OURS] is the same claim from the other side: a reseller takes possession of the relationship; a gateway routes through a relationship that already belongs to you.
Second concern: can the gateway see or reuse your key?
The second worry is about the secret itself — once you paste a provider key into a console, does anyone on the team (or the platform) get to read it back? The page states the security model in two clauses: the secret is never returned to a client after creation, and rotation replaces it rather than revealing it [OURS, read 2026-10-15].
Read the second clause closely, because it is the one that changes your operational behaviour. “Rotation replaces it rather than revealing it” means that when you need to change a key, the flow is to mint a replacement — not to have the old one shown to you so you can copy it somewhere safer. A system that can show you the secret is a system that can hand the secret to anyone with the same access; a system that only ever accepts a new value is a system that treats the old value as burned. Both properties are stated on the page, and both are audit-friendly: you can test that a key cannot be read back, and you can rotate without ever seeing it.
What you give up, stated plainly
The same page is honest about the cost of bringing your own key. Your rate limits are still yours [OURS, read 2026-10-15] — and that is a feature of your contract that travels with the key. If your provider plan allows a fixed number of requests per minute, routing through a gateway does not raise that ceiling. A reseller might pool and re-sell capacity; the gateway’s failover chain can catch what a limit rejects, but it cannot conjure capacity the upstream will not sell. Teams that want the gateway’s buffering should read this clause before they choose BYOK, because the correct framing is not “BYOK loses rate limits” but “BYOK keeps the rate limits you already have.”
What you keep is everything else on the page: routing through the same pool, automatic failover, logs that explain every decision, per-key enable and disable with role-gated access [OURS]. Your contract stays with your provider; the safety net is the gateway’s.
The pricing page as a cross-check
Two lines on the pricing page corroborate the BYOK framing rather than contradicting it. The first is a $0.00 routing fee [OURS, read 2026-10-15] — the platform is funded by optional team plans, not by a spread on token traffic [OURS]. If revenue came from a margin, a BYOK path that sidesteps the margin would be a threat; with subscriptions funding the product, a gateway has no reason to steer you off your own keys. The second line is the caveat that goes the other way: the $0.00 fee applies to top-ups and subscriptions on the Hacker and Team plans, while BYOK traffic may carry a platform fee, and Enterprise contracts are quoted individually [OURS]. The pricing page says that explicitly — so the “zero markup” framing is a statement about token price, and BYOK is a question of where the fee, if any, sits.
What your own key routes to, as a concrete pool member
To see what a first-class member looks like, pick a model your own contract would actually bill. The model page for anthropic/claude-fable-5.1 lists it at $10.00 per million input tokens and $50.00 per million output tokens [VENDOR, read 2026-10-15], with a 1M context window and a 128K maximum output [VENDOR]. If your Anthropic contract negotiates a lower rate, a BYOK key routes to that same model at your contracted price — the gateway’s job is to reach the model, and your job is to keep the rate you negotiated. The invoice relationship stays with your provider, which is exactly the “not the reseller” sentence.
Two questions to ask before you choose
Ask your gateway vendor two questions and the BYOK decision almost answers itself. First: when my provider key is in the pool, does a failover genuinely land on it — or is it skipped in favour of your own credits? The answer should be the sentence the BYOK page prints: first-class membership in the routing pool. Second: can anyone read my provider secret back out of your console? The answer should be the other sentence: never returned to a client after creation, and rotation replaces rather than reveals. If both answers are printed on a page you can verify, BYOK is a configuration choice rather than a leap of faith.
The takeaway
The BYOK decision is a trade of two properties, and both are stated on the page. You keep your provider contract — your negotiated rates, your committed spend, your rate limits — and the gateway routes over it as a first-class pool member whose failover chain really reaches your key. You also keep a security model in which the secret is never handed back and rotation means replacement, not disclosure. The honest cost is that your rate limits travel with you, because the contract is yours. “Your provider contract. Our gateway.” is a division of labour, not a slogan: the relationship stays with your provider, and the routing, failover, logs and role-gated access stay with the gateway.
Sourcing note: the BYOK tagline, the first-class pool membership, the never-returned-after-creation clause, the rotation-replaces-not-reveals rule, the retained rate-limit statement, the per-key enable/disable and role-gated access description, the $0.00 routing fee and the BYOK platform-fee caveat are OrcaRouter’s own product copy and configuration descriptions, read from the BYOK and pricing pages on 2026-10-15 [OURS]. The anthropic/claude-fable-5.1 price of $10.00 per million input tokens and $50.00 per million output tokens, its 1M context window and its 128K maximum output are the provider’s published figures as shown on the model page [VENDOR]. No third-party benchmark or market figures are used. Telemetry figures are rolling and will drift. Read 2026-10-15.
