BYOK API Keys
Bring Your Own Key (BYOK) lets you add your own provider API keys for OpenAI, Anthropic, Google, Azure OpenAI, and any other LiteLLM-supported provider. BYOK is included on every tier — Free, Pro, Team, and Enterprise — and keys are stored in GCP Secret Manager, never in the database.
Available on every tier
BYOK is included on Free, Pro, Team, and Enterprise. There is no managed-LLM tier and no credit system on any plan — every governed agent call uses one of your own provider keys. Free accounts can store unlimited keys, label them, and bind them to specific agents; paid tiers raise governed-agent and gateway-token caps but do not gate the BYOK key store itself.
How keys are stored
Provider keys are stored in GCP Secret Manager in production, never in the database. The database only holds a masked hint (e.g., sk-proj-***...abcd) so you can identify which key is configured. In local development, keys are encrypted with AES-256-GCM. Enterprise customers can additionally route storage to an external secret backend (HashiCorp Vault, CyberArk, AWS Secrets Manager) via Settings → Secret Backend.
Multi-key labels and agent bindings
You can store multiple keys per provider — give each a label (e.g., “Production”, “Staging”, “Personal”) and bind specific keys to specific agents from Settings → Keys. Up to 25 active bindings per agent. Key health is automatically re-validated every six hours; expired or revoked keys surface in the SOC console (Team+) or the agent monitor (Free / Pro).
Supported providers
- OpenAI — GPT-5.2, GPT-4o, o3, o4-mini, and other models
- Anthropic — Claude Opus 4.6, Sonnet 4.6, Haiku 4.5
- Google — Gemini 3.1 Pro, Gemini 2.5 Flash
- xAI, Mistral, DeepSeek, Groq — direct provider keys
- Gateways (Team and above) — LiteLLM Proxy, Azure AI Foundry / Azure OpenAI, AWS Bedrock, Vertex AI, or any OpenAI-compatible endpoint you host (vLLM, Ollama, your own inference server)
MFA requirement
Saving a provider key — adding or updating one — requires a verified (MFA) session in the browser. If MFA is not enabled on your account, you'll be prompted to set it up before proceeding. Deleting a key requires a fresh sign-in check instead. This protects against unauthorized key access if your session is compromised.
Navigate to Keys settings
Go to Dashboard → Settings → Keys and stay on the LLM Providers tab. You'll see a list of supported providers with their current status (configured or not configured).
Complete MFA verification
Click Add Key next to the provider you want to configure. If MFA is not already verified for this session, you'll be prompted to enter your authentication code.
Enter your API key
Paste your provider API key into the input field. The key format is validated before saving:
- OpenAI keys start with
sk-proj-(project keys) orsk-(legacy) - Anthropic keys start with
sk-ant- - Google keys vary by authentication method
Verify the key is active
After saving, the provider shows a green status indicator and a masked hint of your key (e.g., sk-proj-***...abcd). Governed agents can now route calls to this provider's models, and you can pick them when configuring an agent in AI Company → Agents.