> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# BYOK, Bring Your Own Key

> Use your email provider with your credentials, same front door, your account on delivery.

## Why use it

Some teams **already pay** an email provider and don't want two send systems in the app. **BYOK** connects that provider to the workspace: you **still call the Notifique API** (`/v1/...`), and the platform decides **who delivers**, your external account or internal fallback.

Analogy: you use the **same building entrance** (Notifique API), but the **delivery badge** can be from your carrier.

***

## When to use

| Situation                                                                  | Does BYOK make sense?                                                       |
| -------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Existing contract with an external email provider (Resend or Amazon SES)   | **Yes**                                                                     |
| Want a single endpoint in code and automatic failover                      | **Yes**                                                                     |
| Already have a Firebase project / APNs key for mobile push                 | **Yes**, see [Firebase](/en/byok/firebase) and [APNs](/en/byok/apns)        |
| Only use Notifique infrastructure                                          | Not needed                                                                  |
| Email with domain **only** on external provider, not approved on Notifique | **No**, see **[Resend](/en/byok/resend)** or **[Amazon SES](/en/byok/ses)** |

***

## How it works in practice

1. Register the external provider in the workspace (order and activation per channel).
2. On send, Notifique **tries the external path first** (your credentials).
3. If it fails → **fallback** to internal providers (per configuration).
4. Telemetry records `EXTERNAL` vs `INTERNAL`, sanitized response, and external ID.

### Billing

* Every email enqueued on Notifique (BYOK or internal) **consumes 1 email credit** (or the prepaid email price).
* You still pay the external provider (Resend/SES) for delivery on **your** account.
* Internal failover does **not** double-charge the same send (debit already happened at enqueue).

### Security

* Credentials **encrypted**; after saving, API **does not return** secret in plain text.
* Update = **rotate** (replace), not "read back".

<Info>
  Up to **two** external integrations per channel (limit may evolve, check the product).
</Info>

***

## Email providers

| Provider       | Credential                   | Docs                           |
| -------------- | ---------------------------- | ------------------------------ |
| **Resend**     | API key (`re_...`)           | **[Resend](/en/byok/resend)**  |
| **Amazon SES** | Access Key + Secret + region | **[Amazon SES](/en/byok/ses)** |

## Push providers

| Provider           | Credential                           | Docs                              |
| ------------------ | ------------------------------------ | --------------------------------- |
| **Firebase (FCM)** | Service account JSON                 | **[Firebase](/en/byok/firebase)** |
| **APNs**           | Key ID + Team ID + Bundle ID + `.p8` | **[APNs](/en/byok/apns)**         |

***

## Next steps

* **[Resend (email)](/en/byok/resend)**
* **[Amazon SES (email)](/en/byok/ses)**
* **[Firebase (push)](/en/byok/firebase)**
* **[APNs (push)](/en/byok/apns)**
* **[Email, introduction](/emails-api/como-funciona/index)**
* **[Push, introduction](/en/push-api/como-funciona/introducao)**
* **[SMS, introduction](/sms-api/como-funciona/index)**