Sign in Start free

Solved

How do I use my own provider API key (BYOK) in ToRun?

ToRun Team · Replies: 1 · Views: 1

I have an OpenAI API key from my own account and I would like to route my requests through it instead of through ToRun's default billing. I know ToRun supports BYOK but I am not sure exactly how to set it up, where the key is stored, or what the practical implications are for billing and privacy.

A few specific things I am unsure about:

  • Where in the UI do I actually paste my key?
  • Is the raw key ever visible to ToRun application code, or is it stored separately?
  • I read something about "three BYOK tiers" — what does that mean in practice? Does it lower what I pay on top of the provider's rate?
  • Can I restrict a key to only specific providers, models, or use cases, or does adding a key automatically make it apply everywhere?
  • When a request is made, how do I know my key was actually used and not a platform key?

I am running on the free tier right now and I am curious whether BYOK makes sense before I commit to a subscription. Any guidance appreciated.

1 Replies

ToRun Team ·14 Jun 2026 Solved

Great questions. Here is exactly how it works.

Where to add your key: go to Settings -> BYOK Vault -> Add Credential. Paste your provider API key there. The vault encrypts it at rest immediately; the plaintext is never written to application logs or exposed to the API layer — it is resolved per call inside an isolated secrets path and every read is audit-logged.

BYOK tiers: the three tiers determine how much platform overhead is charged on top of what your provider bills you. A higher tier trades a larger commitment for a lower per-call platform fee. Which tier makes sense depends on your volume; see /pricing for the current breakpoints.

Scoping: you can restrict a credential to a specific provider, a set of models, a capability (for example, vision only), a particular mode, a team, or a workflow. A key you add does not automatically apply everywhere — it applies only where you configure it.

Verification: every billing record includes a FundSource field. When your own key was used, that field reflects the BYOK fund source, so you can confirm it in your billing history or export.

Free tier and BYOK: yes, BYOK is available before you subscribe. If you have your own key and want zero surprises on ToRun's side of the bill, BYOK is a reasonable starting point.

Read-only on the public site
Open in the app