BYOK · Bring Your Own LLM Key

Once the key is set up, where you pick the model:AI Assistant · Agents inside a workflow

BYOK (Bring Your Own Key) means to save your own model Provider credentials in the Credential Center and let the workflow use the credentials to initiate model requests. The Provider will record usage and charges on your account side, and the costs shown in Braidrun are only estimates.

Why BYOK

• Transparent Billing — Token consumption is directly recorded in your own LLM account, and Braidrun does not transfer or increase prices.
• Model Selection — You can use models that are enabled for the account associated with the credential and supported by the current runtime. Refer to the Provider and the in-product list for model names and regional availability.
• Quota and current limit — Provider-side TPM and RPM limits, account balance, and regional policies still apply. Make any required changes in the corresponding Provider account.
• Can be rotated — You can revoke the old Key in the Provider console, and then update it to the new value in the Credential Center.

Supported Providers

Common Providers recognized by the current UI include:

• OpenAI / Anthropic / OpenRouter / DeepSeek / Google / NVIDIA / DashScope / Kimi / MiniMax / Z.ai
• Claude Code — Anthropic API Key or Claude Subscription Token (credential provider=claude_code_oauth)
• Codex — OpenAI API Key or Codex Subscription auth.json (Credentials provider=codex_subscription)

A Provider appearing in the UI does not guarantee that every model is available. Availability still depends on credential permissions, the model ID, API compatibility, and network access from the deployment.

Step 1: Go to Provider to GET the Key

Step 2: Save to Credential Center

1. "Credential Management" on the left → "New Credential".
2. Select an actual Provider, such as openai, anthropic, or openrouter.
3. Use labels to distinguish environments and uses, for example:
   • OpenAI · Content Team · prod
   • Anthropic · Personal test
   • OpenRouter · R&D Budget
4. Paste the Key given to you by the Provider and select personal or team scope. The label is only for people to see, and it can be searched by Provider during runtime.
5. Save. Platform encryption and storage.

Step 3: Agent declares provider

agents:
  writer:
    preset: writer
    overrides:
      llm_config:
        models:
          - model: anthropic/claude-sonnet-4.5
            provider: anthropic

provider: anthropic means “use Anthropic credentials”; it does not refer to a credential label. If the same Provider has multiple credentials, select the intended credential in the workflow credential settings.

AI Assistant: Configure Current Account

The in-app AI assistant no longer depends on centralized admin configuration. Go to Account Settings → AI Assistant to choose the model provider, or choose API key / subscription-quota mode in the Claude Code / Codex section. Saving only affects the current account.

Step 4 (Optional): Configure Provider Details

Some Agent types expose dedicated fields for a base URL, OpenRouter identification headers, or subscription authentication. Only fill in fields shown in the Agent configuration panel. The credential center’s “Test” action only verifies that the encrypted value can be decrypted; it does not call an external API to check balance, model access, or network connectivity.

Multi-Key Ledger Sharing

Scenario: You want to keep accounts by department, or you have two sets of keys for development/production.

1. Create independent credentials for each Key, and use labels to write down the department, project and environment.
2. In the credential settings of each workflow, select the corresponding credentials for the same provider.
3. On the OpenAI side, projects are divided into projects to track token consumption, and the bills of each project are naturally separated.

Cost Tracking

Even if the bill is on the Provider side, Braidrun still tracks the token and the estimated cost converted from the current price of the model:

• The top summary of each execution shows tokens + estimated cost
• The execution analytics page aggregates over 24 hours, 7 days or 30 days, with trends, status distribution and top workflows
• The platform does not meter BYOK usage and sets no daily token or spend cap; your provider's own quotas and rate limits still apply

Note that Braidrun's estimates are based on the public provider price list - if you take advantage of discounts (OpenAI Enterprise / DeepSeek quarterly contract), the real bill will be lower than the estimate.

Rate Limiting And Retries

Your Key has a TPM (Tokens Per Minute) upper limit. The platform has three layers of protection:

1. Provider current limit (hard on Provider side, if it exceeds 429)
2. Braidrun internal TPM soft limit (to avoid one-time explosion)
3. step-level retry.backoff (transient 429 automatic backoff retry)

Key Rotation

1. Create a new Key on the Provider side (do not revoke the old one).
2. Braidrun Credential Center → Find the corresponding credential → Paste the new Key in "Update Value".
3. Test the new key with a low-risk workflow and confirm that currently running tasks have been completed.
4. After confirming that the new Key is normal, go to the Provider side to revoke the old Key.

FAQ

Can Braidrun see my Key value?

The runtime platform service needs to use the clear text Key to call the Provider - this moment is technically visible. But:

• Credentials are encrypted with AES-256-GCM when written to the database, so no plaintext appears in a DB dump;
• Credentials are decrypted only within the execution scope where they are needed; plaintext values are not written to logs, workflow definitions, or execution snapshots;
• The hosting method of deployment keys and credential encryption master keys is the responsibility of the deployment administrator; if an external KMS/HSM is required, it must be confirmed during procurement or deployment review whether the current version has been connected.

Can I use different credentials on different Agents?

Yes. Different Agents can choose different Providers or credential sources. Whether you can fall back to platform credentials when not explicitly configured depends on the current deployment and account AI configuration; the parsing results should be confirmed through an actual execution before going online.

Next

• Credentials — Credential Center for more details
• Agent Configuration Guide — Which overrides fields are used with provider