Function getBYOKKey

apps/sim/lib/api-key/byok.ts:43–88

(
  workspaceId: string | undefined | null,
  providerId: BYOKProviderId
)

 * and reading fresh keeps revocation immediate across ECS tasks.
 */
export async function getBYOKKey(
  workspaceId: string | undefined | null,
  providerId: BYOKProviderId
): Promise<BYOKKeyResult | null> {
  if (!workspaceId) {
    return null
  }

  try {
    const keys = await db
      .select({ id: workspaceBYOKKeys.id, encryptedApiKey: workspaceBYOKKeys.encryptedApiKey })
      .from(workspaceBYOKKeys)
      .where(
        and(
          eq(workspaceBYOKKeys.workspaceId, workspaceId),
          eq(workspaceBYOKKeys.providerId, providerId)
        )
      )
      .orderBy(asc(workspaceBYOKKeys.createdAt), asc(workspaceBYOKKeys.id))

    if (!keys.length) {
      return null
    }

    const startIndex = nextRotationIndex(`${workspaceId}:${providerId}`, keys.length)
    for (let offset = 0; offset < keys.length; offset++) {
      const key = keys[(startIndex + offset) % keys.length]
      try {
        const { decrypted } = await decryptSecret(key.encryptedApiKey)
        return { apiKey: decrypted, isBYOK: true }
      } catch (error) {
        logger.error('Failed to decrypt BYOK key, skipping', {
          workspaceId,
          providerId,
          keyId: key.id,
          error,
        })
      }
    }

    return null
  } catch (error) {
    logger.error('Failed to get BYOK key', { workspaceId, providerId, error })
    return null
  }
}

export async function getApiKeyWithBYOK(
  provider: string,