What is bring your own key?
BYOK (bring your own key) means the app uses a key you hold for the model provider, and that provider bills you for the model. The app may still bill you for its own features. You now have two vendors, two dashboards, and a key to store as a secret.
Also called: bring your own key
In plain English
Instead of the app's bundled AI, you paste a key from the model company. That can make the data terms clearer, or it can surprise you with a second invoice. It does not remove the app's logs. Read both current pricing pages. Do not paste the key anywhere except the app's secret field. Bringing your own key means the bill and the data terms may follow your provider account, while the app is still the thing your staff click. Read both. A key with no spend cap is a blank check if a workflow loops. Put a cap on the provider side. Revoke the key in the provider when you stop using the app, or the app can keep spending after you thought you cancelled. Name the key after the app that uses it. A key named 'default' is how you revoke the wrong one and break payroll night. Write the spend cap next to the name. Tape the monthly ceiling where the bookkeeper will see it.
How an owner would use it
Choose BYOK when you already have a provider account and you want that provider's data settings. Set a usage alert there. Revoke the key if you disconnect the app. If you will not watch two bills, use the app's bundled plan and read that plan.
Common mistakes
BYOK is not automatically cheaper or more private. The app can still store prompts. A key with broad permissions is still a skeleton key. Do not share one key across every experiment. Do not assume the provider's consumer privacy toggle applies to API traffic. Read the API data terms.
A worked example
A fractional CFO
The key is in the app vault, the alert is on the provider
This is an illustration, not a customer result. The CFO connects a writing tool with their own model key, stored in the tool's secret field. They set an alert in the model provider's dashboard and keep client figures out of the draft. When they stop using the tool, they revoke that key.
Related terms
Prompts and guides
Questions owners ask
What is BYOK?
Bring your own key means an app calls a model with a credential you control, and the model provider bills that usage.
How do I use BYOK without leaking the key?
Paste it only into the app's secret field, restrict what the key can do if the provider allows, and revoke it when you disconnect.
Does BYOK mean the app cannot see my prompts?
No. The app still receives the prompt in order to send it. You have changed who bills the model, not whether the app has a log. Read the app's terms too.
Product guides are on AI apps for business.