feat: add allow-byok option for ai-gateway (#24274)

## Summary                  
Adds `--ai-gateway-allow-byok` deployment option to control whether
users can use Bring Your Own Key (BYOK) mode with AI Gateway.
When disabled (`--ai-gateway-allow-byok=false`), BYOK requests are
rejected with a 403 and a message directing the admin to enable the
flag. Centralized key authentication works regardless of this setting.
Defaults to `true` (BYOK allowed).

---------

Co-authored-by: Danny Kopping <danny@coder.com>
This commit is contained in:
Yevhenii Shcherbina
2026-04-15 14:16:49 -04:00
committed by GitHub
co-authored by Danny Kopping
parent dd7397b42e
commit dd73ea54bd
13 changed files with 164 additions and 0 deletions
+1
View File
@@ -67,6 +67,7 @@ export interface AIBridgeConfig {
readonly rate_limit: number;
readonly structured_logging: boolean;
readonly send_actor_headers: boolean;
readonly allow_byok: boolean;
/**
* Circuit breaker protects against cascading failures from upstream AI
* provider rate limits (429, 503, 529 overloaded).