# BYOK recipient and credential map

Follow code and credentials through the selected editor, gateway and provider arrangement.

Synthetic route illustration with an optional gateway branch. No network requests or configuration changes are performed.

Source: https://aona.ai/resources/guides/ai-coding-byok-gateway-data-flow/
Sources checked: 2026-09-21

## Two paths to review

### Code context

Client → editor backend → selected model provider

Note: Documented Cursor BYOK example

### Optional gateway

Insert only if your configuration actually uses one

Note: Verify payload and log handling

### Credential

Record which system receives the key or upstream identity

Note: Never put the value in the map

| Hop | Data to identify | Evidence owner |
| --- | --- | --- |
| Client → editor backend | Prompt/context and any credential forwarding | Tool administrator |
| Optional gateway | Payload, logs and provider identity | Gateway owner |
| Model provider | Input/output handling and key scope | Provider-account owner |
| Connected tools | Separate data and grants | Service owner |

## Review checklist

- [ ] Name the exact feature using BYOK
  Do not assume every feature or model request follows the same path.
- [ ] Separate payload and credential recipients
  Record where each travels without collecting token values.
- [ ] Attach the correct terms to each hop
  Review the selected provider account, gateway logging and connected-service scope.

## Included example files

- README.md
- recipient-register.csv
- synthetic-route.json
- approval.md

## Source references

- Cursor: Bring your own API key: https://cursor.com/help/models-and-usage/api-keys (2026-09-21)
- Cursor: Privacy and Data Governance: https://cursor.com/docs/enterprise/privacy-and-data-governance (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.