Bring your own eSIM API keys, explained
What it means to run an eSIM store on provider API keys you hold yourself — what you gain, what you take on, and what to demand of anyone who stores them.
What “bring your own keys” actually means
Bring-your-own-keys, or BYO, describes a platform that operates on accounts you hold rather than accounts it holds. You open an eSIM provider account in your own name, agree terms and rates directly with that supplier, and give the platform API credentials so it can place orders on your behalf.
The same idea usually applies to payments: your customers pay into your own payment account, and the platform never holds the money. The two together are what people mean when they say a platform runs on your accounts, not theirs.
BYO is an administrative arrangement, not a technical one. You are pasting credentials into a settings screen, not writing an integration. The engineering version — calling a provider’s API yourself — is a separate decision with a much larger bill attached.
One limit worth knowing before you compare platforms on this, ours included: “bring your own keys” means your own ACCOUNT, not any supplier you like. A platform can only talk to providers it has written a driver for. Esimbit ships two today — Airalo and Maya — and a third is work we do, not something you can wire up from a settings screen. Ask any BYO platform which suppliers it actually supports before you assume the list is open.
What you gain
Three things, and only the first is really about money.
A cost of goods you can audit
Because the supplier relationship is yours, the price you pay per eSIM is a number you negotiated and can compare against a second quote. On a platform that sells you its own connectivity, that number is set by the platform and there is nothing to compare it against.
A business that survives the platform
If you leave — or the platform folds, gets acquired, or reprices — the provider account, the payment account, the customer list and the domain were always yours. What you lose is software, which is replaceable. What you keep is the business, which is not.
Terms that improve as you grow
Provider rates are negotiable and improve with volume. On a BYO arrangement that improvement lands in your margin. On a wholesale arrangement it lands in somebody else’s, and you find out about it only if they choose to pass it on.
What you take on
This is a real trade and the costs are usually understated by people selling the model. Including us, so here they are in full.
| You now own | What that means in practice |
|---|---|
| The supplier application | An approval process with a form, a company, and sometimes a wait of days or weeks. |
| The commercial relationship | Rates, terms and any minimum commitments are yours to agree and yours to renegotiate. |
| Funding the account | Many providers work on prepaid balance. Running out mid-weekend stops your storefront. |
| Credential hygiene | Keys are secrets. Rotating them, scoping them and revoking them is now your job. |
| First-line diagnosis | When an order fails, you decide whether it is the platform or the provider before anyone can fix it. |
The prepaid balance one catches almost everybody once. Set a low-balance alert on the provider side on the day you connect, not the day you run out.
What to demand of anyone holding your keys
Handing API credentials to a third party is a genuine risk and it deserves more scrutiny than it normally gets. Those keys can buy eSIMs on your account, which is to say they can spend your money. Ask every platform on your shortlist the following, and treat vagueness as an answer.
- Are credentials encrypted at rest, and can anyone at the company read them back in plain text?
- Are they ever redisplayed in the interface after saving? They should not be — a masked field showing the last few characters is enough to identify a key without exposing it.
- Are they ever sent to the browser? Secrets that reach client-side code are visible to anyone who opens the developer tools.
- Can the provider issue scoped credentials that only do what the platform needs? Use the narrowest scope the supplier offers.
- Does the platform record which environment a set of keys belongs to, so sandbox and live cannot be confused?
- How do you revoke access if you leave? Ideally by rotating the key at the provider, with no cooperation needed from the platform.
For what it is worth, Esimbit stores credentials encrypted, shows only the last four characters after saving, never renders them client-side, accepts them write-only through the API, and records the environment each connection belongs to. That is stated so you can check it, not so you can take our word for it — and the last question on the list is the one that protects you regardless of the answers: your keys are revocable at the provider, by you, without asking us.
Whether BYO is right for you
The deciding question is not technical sophistication. It is whether you want a supplier relationship at all.
- If you would rather not deal with a provider, ever: BYO is the wrong model and a wholesaler is the right one. This is a legitimate preference, not a lack of ambition.
- If you are testing whether anyone will buy: start on a platform that sells you the eSIMs. Come back when you have proven demand.
- If you sell a few hundred orders a month and expect that to grow: the audit-your-own-cost argument starts paying, and the paperwork is a few hours once.
- If eSIMs are strategic to your business rather than an add-on: BYO, without much hesitation. Owning the supply relationship is the whole game at that point.
One thing that is not a reason to choose BYO: because it sounds more professional. It is more work, and the work only pays back at volume.
Frequently asked questions
What does bring your own keys mean for an eSIM reseller?
That the eSIM provider account is yours rather than the platform’s. You agree rates directly with the supplier and give the platform API credentials to place orders on your behalf, so your cost per eSIM is a number you negotiated instead of one the platform sets.
Is it safe to give a platform my provider API keys?
It is a real risk that can be managed. Use the narrowest credential scope your provider offers, confirm the platform stores keys encrypted and never sends them to the browser, and check that you can revoke them at the provider without the platform’s cooperation. That last point is what protects you if the relationship ends badly.
Do I need technical skills to bring my own keys?
No. Connecting keys is pasting credentials into a settings screen. What it requires is a commercial relationship with a supplier — an application, terms and usually a prepaid balance — which is administrative work, not engineering.
What happens to my business if I leave the platform?
On a BYO arrangement the provider account, the payment account, the customers and the domain were always in your name, so they stay with you. You lose the software layer. Check before you sign that nothing you depend on is registered in the platform’s name rather than yours.
Can I use the same provider account somewhere else at the same time?
Usually yes — an API credential is not exclusive, and resellers commonly keep a provider account connected to more than one system during a migration. Check your supplier’s terms, and issue separate credentials per system so you can revoke one without breaking the other.