BYOK · Bring Your Own LLM Key

BYOK (Bring Your Own Key) is Braidrun's core concept for LLM Token billing: you keep the API Key you get from OpenAI / Anthropic / DeepSeek / Kimi / OpenRouter, etc., and Braidrun will help you adjust it without increasing the price.

Why BYOK

• Transparent billing — Token consumption is directly recorded in your own LLM account, and Braidrun does not transfer or increase prices.
• Model freedom — You can use your own account's Claude Opus, GPT-5, and any OpenRouter routing small model - without being restricted by the platform's unified package.
• Quota and current limit are in your control — Need a higher TPM? Just go to OpenAI and upgrade to Tier. No need to deal with the platform.
• Safe and controllable — Key can be revoke in the OpenAI console at any time, and you have the final say on the entire link.

Supported Providers

• OpenAI — GPT-4.1 / 4.1-mini / GPT-5 / o1 / o3
• Anthropic — Claude Opus 4 / Sonnet 4 / Haiku 4
• Claude Code — Anthropic API Key or Claude Subscription Token (credential provider=claude_code_oauth)
• Codex — OpenAI API Key or Codex Subscription auth.json (Credentials provider=codex_subscription)
• DeepSeek — DeepSeek-V3.5 / DeepSeek-Reasoning
• Kimi — Kimi K2 / 128K context
• OpenRouter — Routing via OpenRouter to any of its supported models (Mistral / Llama / Gemini etc.)
• Internal LLM (Enterprise version can access self-hosted vLLM / TGI / Ollama endpoint)

Step 1: Go to Provider to GET the Key

Step 2: Save to Credential Center

1. "Credential Management" on the left → "New Credential".
2. Naming suggestions:
   • openai_main / openai_prod / openai_test
   • anthropic_team_budget / anthropic_personal
   • deepseek_production
3. Type: api_key; Value: Paste the key given to you by the Provider; Namespace: Individual or Team (depending on whether you are using it alone or sharing it with multiple people).
4. Save. Platform encryption and storage.

Step 3: Bind Provider to Agent

agents:
  writer:
    preset: writer
    overrides:
      model: claude-opus-4-7
      provider: anthropic_team_budget    # ← 凭据中心的凭据名

AI Assistant: Configure Current Account

The in-app AI assistant no longer depends on centralized admin configuration. Go to Account Settings → AI Assistant to choose the model provider, or choose API key / subscription-quota mode in the Claude Code / Codex section. Saving only affects the current account.

Step 4 (Optional): Configure Provider Details

Some providers require more configuration - api_base, organization id, custom headers. Expand in "Credential Management → Provider Configuration":

# 凭据中心 → Provider 配置
# 类型: OpenAI
api_base: https://api.openai.com/v1   # 或你的代理 / Azure endpoint
organization: org_xxxxx                 # 分账 organization
default_headers:
  OpenAI-Beta: assistants=v2

Multi-Key Ledger Sharing

Scenario: You want to keep accounts by department, or you have two sets of keys for development/production.

1. In the credential center, each Key has an independent name (openai_marketing / openai_engineering).
2. Agents of different workflows are bound to different providers.
3. On the OpenAI side, projects are divided into projects to track token consumption, and the bills of each project are naturally separated.

Cost Tracking

Even if the bill is on the Provider side, Braidrun still tracks the token and the estimated cost converted from the current price of the model:

• The top summary of each execution shows tokens + estimated cost
• The "Data Dashboard" page aggregates by day/week/month
• You can set "Alarm when single execution cost exceeds X"

Note that Braidrun's estimates are based on the public provider price list - if you take advantage of discounts (OpenAI Enterprise / DeepSeek quarterly contract), the real bill will be lower than the estimate.

Rate Limiting And Retries

Your Key has a TPM (Tokens Per Minute) upper limit. The platform has three layers of protection:

1. Provider current limit (hard on Provider side, if it exceeds 429)
2. Braidrun internal TPM soft limit (to avoid one-time explosion)
3. step-level retry.backoff (transient 429 automatic backoff retry)

Key Rotation

1. Create a new Key on the Provider side (do not revoke the old one).
2. Braidrun Credential Center → Find the corresponding credential → Paste the new Key in "Update Value".
3. Wait 1 hour (to let the running execution with the old key finish).
4. Confirm that everything is normal, go to the Provider side to revoke the old Key.

Failover / Fallback

When the Provider occasionally jitters, you can configure fallback in the Agent:

agents:
  writer:
    preset: writer
    overrides:
      model: claude-opus-4-7
      provider: anthropic_main
      fallback:
        model: gpt-4.1
        provider: openai_main

The fallback is automatically switched when the main Provider returns 5xx / rate limit.

FAQ

Can Braidrun see my Key value?

The runtime platform service needs to use the clear text Key to call the Provider - this moment is technically visible. But:

• AES-256-GCM encryption is used when dropping the database, and the plain text cannot be seen in the DB dump;
• Runtime decryption only takes effect in the context of a single step, and does not enter logs, write snapshots, or flow out to other steps;
• Enterprise version supports HSM / KMS integration, key decryption is done in the managed KMS.

Can I Combine Platform Credits with BYOK?

Yes. If the Agent is not equipped with a provider, it will use the unified key of the platform (taking the platform quota); if it is equipped with a provider, it will use your Key. Different steps can be mixed in the same workflow.

Next

• Credentials — Credential Center for more details
• Agent Configuration Guide — Which overrides fields are used with provider