Bring Your Own Key (BYOK)
Point a deployed agent at your own model-provider account instead of the platform default. Supported providers:
| Provider | Key format |
|---|---|
| OpenAI | sk-... |
| Google Gemini | AIza... |
| Anthropic | sk-ant-... |
Add a key
Per deployed agent, in the Dashboard:
- My AIs → open an agent.
- Expand API Keys (BYOK).
- Paste the key for a provider and save. Remove it any time.
Keys are stored encrypted and scoped to that one agent.
How routing works
A request uses your key only when the agent's model provider matches a key you've
added — a gpt-* model uses your OpenAI key, claude-* uses your Anthropic key,
gemini-* uses your Gemini key. Otherwise it falls back to the platform default.
So: set the agent's model to one from the provider whose key you added.
Your Custodian Labs key still applies
BYOK covers the LLM call only. Your CUSTODIAN_SDK_API_KEY still authenticates every
request and tracks plan usage and request limits.
Security
Provider keys follow the same rules as any secret — no client-side code, no source control. The BYO Key plan (reduced platform fee for BYOK users) is on the Subscriptions page.