How do I use my own provider API key (BYOK) in ToRun?
I have an OpenAI API key from my own account and I would like to route my requests through it instead of through ToRun's default billing. I know ToRun supports BYOK but I am not sure exactly how to set it up, where the key is stored, or what the practical implications are for billing and privacy.
A few specific things I am unsure about:
- Where in the UI do I actually paste my key?
- Is the raw key ever visible to ToRun application code, or is it stored separately?
- I read something about "three BYOK tiers" — what does that mean in practice? Does it lower what I pay on top of the provider's rate?
- Can I restrict a key to only specific providers, models, or use cases, or does adding a key automatically make it apply everywhere?
- When a request is made, how do I know my key was actually used and not a platform key?
I am running on the free tier right now and I am curious whether BYOK makes sense before I commit to a subscription. Any guidance appreciated.
1 Replies
-
Great questions. Here is exactly how it works.
Where to add your key: go to Settings -> BYOK Vault -> Add Credential. Paste your provider API key there. The vault encrypts it at rest immediately; the plaintext is never written to application logs or exposed to the API layer — it is resolved per call inside an isolated secrets path and every read is audit-logged.
BYOK tiers: the three tiers determine how much platform overhead is charged on top of what your provider bills you. A higher tier trades a larger commitment for a lower per-call platform fee. Which tier makes sense depends on your volume; see /pricing for the current breakpoints.
Scoping: you can restrict a credential to a specific provider, a set of models, a capability (for example, vision only), a particular mode, a team, or a workflow. A key you add does not automatically apply everywhere — it applies only where you configure it.
Verification: every billing record includes a
FundSourcefield. When your own key was used, that field reflects the BYOK fund source, so you can confirm it in your billing history or export.Free tier and BYOK: yes, BYOK is available before you subscribe. If you have your own key and want zero surprises on ToRun's side of the bill, BYOK is a reasonable starting point.