Bring Your Own Keys (BYOK)

BYOK lets you run agents on your own OpenAI or Anthropic API key instead of the platform's. You pay the model provider directly, and those runs are not metered against your credit balance.

Why use BYOK

• You pay the provider, not the platform. Runs made with your key bypass platform credit metering entirely.
• No FREE plan restriction. Agents on the FREE plan can't run without either a key or a paid plan — adding a key unblocks them immediately. See Plans and credits for how the two paths compare.
• You control the model account. Usage, rate limits, and billing for the underlying model calls are whatever your provider account allows.

How keys are stored

Every key you add is encrypted with AES-256-GCM before it touches the database. Keys are org-owned — scoped to your organization, not to an individual user — and the platform never returns the raw key value back to you or any API response once it's saved. If you need to change a key, you replace it; you can't view the old one.

Adding a key

1. Go to your organization's settings and open the API keys section.
2. Choose the provider: OpenAI or Anthropic.
3. Paste the key and save.

Once saved, the key is available to any agent in your organization that's configured to use it. You don't need to touch the agent's tool configuration — model calls route through your key automatically wherever BYOK is enabled for that agent or organization.

Which calls a key covers

A key covers model calls made by the agentic harness during a run — the multi-turn tool-calling loop that drives the agent. It does not cover:

• Connector calls to third-party services (Slack, Salesforce, etc.) — those use their own credentials, also AES-256-GCM encrypted and org-owned.
• Infrastructure costs if you've deployed to your own cloud (BYOC) — that's a separate SSH-based connection to infrastructure you control.

Rotating or removing a key

Add a new key to replace an old one at any time. Because the platform never displays a saved key back to you, there's no "view" step — only replace or remove. Removing a key on a FREE-plan organization with no other key configured means runs will fail until you add a key or upgrade to a paid plan.

Mixing BYOK and platform credits

An organization can have both a saved key and an active paid plan. When a key is present, it takes priority — runs use it and are not metered. If you remove the key, the organization falls back to platform credits automatically, provided the plan is paid and the credit balance is positive.

Troubleshooting

If a run fails immediately with an upgrade-required error, the organization has no BYOK key and is on the FREE plan. See Troubleshooting for the full list of "run won't start" causes and fixes.