> We allow end users to add API keys directly

This seems like a bad idea to me these days. Companies doing this make themselves a target and then get hacked like OpenCode. Customer accounts get drained or bills run up.

Run your own gateway behind a firewall / vpn. I personally use GoModel + Tailscale.

https://news.ycombinator.com/item?id=50133401 (OpenCode hacked story)