AI providers: BYOK, hosted & local

What changes when you bring the provider account

• The provider account, model availability, API limits, and provider charges remain under your control.
• Scans and photos need a vision-capable model. A text-only model cannot inspect the pixels on an image-only page.
• Provider retention, training, and regional terms differ. Check the selected route before sending a sensitive document.
• A model can return an incomplete or incorrect value. The source-first review and export steps stay the same whichever route you select.

How BYOK document extraction works inside Dynamite Docs

01. Connect your API key in settings

Open Settings > AI & Processing in your workspace. Choose your provider from Google Gemini, Groq, Mistral, OpenAI, Anthropic, OpenRouter, or Custom Endpoint. Paste your secret key and click Verify & Save Key. The server runs an instant health check to discover available models and encrypts the key at rest using AES-256-GCM.

02. Configure active models and fallback routing

Choose from the models discovered for the verified key. If you configure a fallback, make sure it also supports the document type and satisfies the same privacy policy. A fallback reduces dependency on one route but does not guarantee availability.

03. Set data privacy and residency policies

Use the policy controls to exclude routes that do not meet the active training or residency rule. When cloud transmission is not acceptable, use the signed local Ollama companion on an eligible plan.

04. Extract, review, and export

Upload a supported document and run it with the selected route. Compare proposed fields and rows with the source before export. Free and Starter own-key pages use the monthly PE allowance; Pro and Scale own-key runs cost 0 PE. Provider charges and limits still apply.

Supported providers, endpoints, and architectural controls

The available model list is discovered from each verified account. Provider keys are encrypted with AES-256-GCM before storage:

• Google Gemini: Use models returned by the connected Google account and check vision support.
• Groq Cloud: Use models returned by the connected Groq account and its current limits.
• Mistral AI: Use models returned by the connected Mistral account and its regional terms.
• OpenAI & Anthropic: Choose a vision-capable model for scans and images; check current API terms.
• Cloud Platforms: Azure OpenAI, Amazon Bedrock, Google Vertex AI, and OpenRouter gateways
• OpenAI-Compatible Endpoints: LiteLLM, vLLM, Ollama server, or internal private VPC endpoints
• Local Ollama Companion: Signed loopback connection on port 8756 for model inference on your computer.
• PE treatment: Free and Starter own-key pages use PE; Pro and Scale own-key runs cost 0 PE.

A realistic example

Possible routes for a mixed batch of accounting documents:

Request and response examples

Verify and store an encrypted provider key

POST /api/ai/keys

curl -X POST \
  -H "Authorization: Bearer <clerk_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "groq",
    "apiKey": "gsk_a8b9c0d1e2f3...",
    "preferredModel": "<discovered_model_id>"
  }' \
  "https://app.dynamitedocs.com/api/ai/keys"

{
  "success": true,
  "provider": "groq",
  "status": "connected",
  "discoveredModels": [
    "<discovered_model_id>",
    "<another_available_model_id>"
  ],
  "activeModel": "<discovered_model_id>",
  "verifiedAt": "2026-09-15T15:00:00.000Z"
}

Run document extraction using connected BYOK provider

POST /api/v1/infer

curl -X POST \
  -H "Authorization: Bearer dd_live_9f8e7d6c5b4a..." \
  -F "file=@invoice_2026_09.pdf" \
  -F "docType=Invoice" \
  -F "provider=groq" \
  -F "model=<discovered_model_id>" \
  "https://app.dynamitedocs.com/api/v1/infer"

{
  "id": "ext_9821af4e",
  "docType": "Invoice",
  "peCharged": 0,
  "executionTimeMs": 740,
  "provider": "groq",
  "model": "<discovered_model_id>",
  "columns": ["Item", "Qty", "Unit Price", "Total"],
  "rows": [
    ["Server Hosting Q3", "1", "120.00", "120.00"],
    ["Bandwidth Allocation", "5", "15.00", "75.00"]
  ],
  "metadata": {
    "invoiceNumber": "INV-2026-882",
    "subtotal": "195.00",
    "tax": "17.55",
    "total": "212.55"
  }
}

What to validate before relying on it

Verify that the selected provider supports your document type (multimodal vision vs text) and satisfies active data residency, zero-training, or local loopback policies before processing sensitive files.

Provider billing, key storage, and local processing

With an own-key route, the model provider bills its own API usage and enforces its own rate, model, and account limits. Dynamite Docs plan rules still apply: Free and Starter own-key pages use monthly PE, while Pro and Scale own-key runs cost 0 PE.

Provider API keys are encrypted with AES-256-GCM before storage. The server decrypts a key only when it needs to authenticate a request to that provider. The browser never receives the stored secret after setup.

Retention, training, and regional handling depend on the selected provider and account terms. Use the policy controls to block routes that do not meet the active rule, and verify the provider documentation for the account you connect.

The local Ollama companion is a separate loopback-only service on port 8756. Every companion route requires a signed local token. Use it on an eligible plan when model inference should run on your computer instead of an external provider API.

What provider routing does and does not do

Does

• Sends an authenticated extraction request to the hosted, own-key, custom, or local route you select.
• Encrypts stored provider keys with AES-256-GCM.
• Discovers the models currently available to a verified provider account.
• Applies configured provider-policy and fallback rules before an eligible request is routed.
• Supports model inference through the signed local Ollama companion on an eligible plan.

Does not

• Does not control a provider's prices, model availability, rate limits, or account terms.
• Does not make a text-only model capable of reading an image-only document.
• Does not guarantee that a fallback route is available or policy-compatible.
• Does not make a model response correct without source review.
• Does not bypass Free or Starter PE limits when you use your own key.

Keep the review contract stable when the model changes

Provider models and account limits change. The useful constant is the workflow around them: a supported source file, proposed fields and rows, source review, corrections, and an explicit export.

Changing the model does not prove that its output matches the last model. Keep required columns and validation checks in the workspace, then compare high-risk values with the source before delivery.

Choose a hosted, own-key, custom, or local route according to the document type, provider terms, and the controls your organization requires.

Questions, answered

Related integration articles

• Connect your own OpenAI, Anthropic, or Mistral API keys for direct extraction
• Extract changing supplier invoice layouts without setting up template zones