clevernameHelp Center

BYOK API Keys

Bring Your Own Key (BYOK) lets you add your own provider API keys for OpenAI, Anthropic, Google, Azure OpenAI, and any other LiteLLM-supported provider. BYOK is included on every tier — Free, Pro, Team, and Enterprise — and keys are stored in GCP Secret Manager, never in the database.

Key Concepts

Available on every tier

BYOK is included on Free, Pro, Team, and Enterprise. There is no managed-LLM tier and no credit system on any plan — every governed agent call uses one of your own provider keys. Free accounts can store unlimited keys, label them, and bind them to specific agents; paid tiers raise governed-agent and gateway-token caps but do not gate the BYOK key store itself.

How keys are stored

Provider keys are stored in GCP Secret Manager in production, never in the database. The database only holds a masked hint (e.g., sk-proj-***...abcd) so you can identify which key is configured. In local development, keys are encrypted with AES-256-GCM. Enterprise customers can additionally route storage to an external secret backend (HashiCorp Vault, CyberArk, AWS Secrets Manager) via Settings → Secret Backend.

Multi-key labels and agent bindings

You can store multiple keys per provider — give each a label (e.g., “Production”, “Staging”, “Personal”) and bind specific keys to specific agents from Settings → Keys. Up to 25 active bindings per agent. Key health is automatically re-validated every six hours; expired or revoked keys surface in the SOC console (Team+) or the agent monitor (Free / Pro).

Supported providers

  • OpenAI — GPT-5.2, GPT-4o, o3, o4-mini, and other models
  • Anthropic — Claude Opus 4.6, Sonnet 4.6, Haiku 4.5
  • Google — Gemini 3.1 Pro, Gemini 2.5 Flash
  • Ollama / Local LLMs — Llama, Qwen, Mistral, and any local model via BYOL
  • Additional providers — Any provider supported by LiteLLM routing

MFA requirement

Adding or modifying API keys requires multi-factor authentication. If MFA is not enabled on your account, you'll be prompted to set it up before proceeding. This protects against unauthorized key access if your session is compromised.

Step-by-Step Guide
1

Navigate to API Keys settings

Go to Dashboard → Settings → API Keys. You'll see a list of supported providers with their current status (configured or not configured).

API Keys settings page showing a list of providers with status indicators and Add Key buttons
The API Keys page shows each provider and whether a key is configured.
2

Complete MFA verification

Click Add Keynext to the provider you want to configure. If MFA is not already verified for this session, you'll be prompted to enter your authentication code.

Important
MFA verification is required every time you add, update, or delete an API key. This is a security requirement and cannot be disabled.
3

Enter your API key

Paste your provider API key into the input field. The key format is validated before saving:

  • OpenAI keys start with sk-proj- (project keys) or sk- (legacy)
  • Anthropic keys start with sk-ant-
  • Google keys vary by authentication method
Add API Key modal with a masked input field, provider label, and Save button
Paste your key and click Save. The key is sent directly to Secret Manager and never stored in the database.
4

Verify the key is active

After saving, the provider shows a green status indicator and a masked hint of your key (e.g., sk-proj-***...abcd). You can now select this provider's models in the chat model selector.

Tip
Test your key by starting a chat and selecting a model from that provider. If the key is invalid or has insufficient permissions, you'll see a clear error message with the specific issue.
Related Articles
Local LLMs (Ollama, vLLM)Integrations OverviewIDE GatewayMCP Connections