Ask HN: How to manage AI APIs for SaaS application?

Posted by sbinnee on Wednesday May 20, 2026 @12:11AM
from the ask-hn dept.

I want to build an AI app. My idea is to support BYOK (bring your own key) or to manage one API key for each user.

What are the solutions to issue a lot of API keys for commercial apps? I would love to hear from the community.

( 6 comments | 3 points | on HN )

Re:Ask HN: How to manage AI APIs for SaaS application? by jaspanglia on Wednesday May 20, 2026 @12:18AM (#48203029)

BYOK is becoming more common for AI SaaS. Interested to know how people handle rate limiting and key security at scale.

[ Parent | on HN ]

Re:Ask HN: How to manage AI APIs for SaaS application? by mmarian on Wednesday May 20, 2026 @02:21PM (#48211855)

I've used LiteLLM for my 1k-user service https://LibreThinker.com Works okay-ish, but some vendors now default to MFA on API keys (eg OpenAI) which makes things tricky; I decided to simply let those fail for now.

[ Parent | on HN ]

Re:Ask HN: How to manage AI APIs for SaaS application? by sbinnee on Wednesday May 20, 2026 @07:16PM (#48215660)

I am a bit familiar with litellm. Do you proxy server?

[ Parent | on HN ]

Re:Ask HN: How to manage AI APIs for SaaS application? by warrenshi on Thursday May 21, 2026 @12:31AM (#48217887)

Honestly the API key part ended up being the easy part for me.

The messy stuff was abuse prevention, retries/fallbacks, and sudden cost spikes once real users started using different workflows.

[ Parent | on HN ]

Re:Ask HN: How to manage AI APIs for SaaS application? by crionuke on Thursday May 21, 2026 @08:17AM (#48221429)

i did this with aws kms. i had a root key that encrypted & decrypted data keys, which were unique for each customer. those data keys then encrypted & decrypted sensitive customer info. so called envelope encryption

[ Parent | on HN ]

Re:Ask HN: How to manage AI APIs for SaaS application? by freakynit on Friday May 22, 2026 @07:03AM (#48234224)

As someone rightly pointed out already, issuing these many keys (a few thousands) is not an issue. But, handling abuse, retries, spikes, fallbacks, logging, monitoring, hacking attempts, etc. ... these are the real issues that you need to focus on.

My suggestion: go with openrouter... it offers management keys that you can use to issue keys on the fly for your customers. You can also set quota per key.

With this setup, everything gets offloaded to them. You just pay 5% commission (when you load credits to their platform).

[ Parent | on HN ]