Liya Engine

Bring Your Own Key (BYOK) lets you route Liya Engine's model calls through your own AI provider accounts. Your costs are billed directly to your provider account, and your data stays within your provider relationship.

For the full configuration schema, see BYOK Configuration.

When to use BYOK

Cost control — use negotiated enterprise rates or committed spend with your provider
Data residency — keep all model calls within your Azure tenant or private endpoint
Model access — use fine-tuned models or private deployments not available on Liya Engine's shared infrastructure
Compliance — satisfy procurement requirements that mandate your own provider contracts

Step 1: Choose your provider

Provider	Config key	Notes
OpenAI	`openai`	GPT-4o, GPT-4 Turbo, o1
Anthropic	`anthropic`	Claude Sonnet, Claude Haiku
Azure OpenAI	`azure`	Highest priority when configured — use for data residency

Azure OpenAI takes precedence over Anthropic, which takes precedence over OpenAI.

Step 2: Configure BYOK

Use PATCH /dashboard/account/config with your provider credentials:

OpenAI

PATCH https://api.liyaengine.ai/dashboard/account/config
Authorization: Bearer <jwt>
Content-Type: application/json
 
{
  "provider_config": {
    "mode": "byok",
    "openai": {
      "api_key": "sk-...",
      "default_model": "gpt-4o"
    }
  }
}

Anthropic

{
  "provider_config": {
    "mode": "byok",
    "anthropic": {
      "api_key": "sk-ant-...",
      "default_model": "claude-sonnet-4-6"
    }
  }
}

Azure OpenAI

{
  "provider_config": {
    "mode": "byok",
    "azure": {
      "api_key": "your-azure-key",
      "endpoint": "https://your-resource.openai.azure.com",
      "deployment_name": "gpt-4o",
      "api_version": "2024-02-15-preview"
    }
  }
}

Step 3: Verify

After saving, your next API call will route through your provider key. Check the usage object in the response — if the call succeeded, BYOK is active.

You can also verify from the dashboard: Settings → Provider will show the active mode and masked key preview.

Step 4: Override model per intent (optional)

Configure modelConfig to use different models per intent category:

{
  "modelConfig": {
    "strategy": "cost-optimised",
    "overrides": {
      "resume_analysis": "gpt-4o",
      "general_chat": "gpt-4o-mini",
      "mock_interview": "claude-sonnet-4-6"
    },
    "cost_limit_usd_per_request": 0.05
  }
}

See Model Configuration for all strategy options.

Security

API keys are encrypted at rest using AES-256-GCM with a per-tenant key derivation
Keys are never returned in API responses — only the masked preview is shown
Keys are never logged or included in audit entries
Rotate your provider key in the provider's dashboard, then update via PATCH /dashboard/account/config

Switching back to managed mode

To stop using BYOK and return to Liya Engine's managed infrastructure:

PATCH https://api.liyaengine.ai/dashboard/account/config
Authorization: Bearer <jwt>
Content-Type: application/json
 
{
  "provider_config": {
    "mode": "managed"
  }
}

Troubleshooting

BYOK_AUTH_FAILED — Your provider key is invalid or expired. Verify the key in your provider dashboard and update it.

BYOK_QUOTA_EXCEEDED — Your provider account has hit its usage limit. Check your provider dashboard for quota or billing issues.

BYOK_MODEL_NOT_FOUND — The model specified in default_model or overrides is not available in your provider account. For Azure, check that the deployment name matches exactly.

BYOK_ENDPOINT_UNREACHABLE — Azure endpoint URL is incorrect or your Azure resource is not running. Verify the endpoint in the Azure portal.

BYOK Setup