BYOK lets your org route AI calls through your own provider account (OpenAI, Azure OpenAI, Anthropic, Google). You keep the contractual relationship with the provider; Keypra is just the workspace.
Lifecycle
Store the key
Paste the key in the Org Keys tab. We base64-encode it into your row in user_api_keys, gated by RLS — never in shared storage.
Test it
A guided test call must succeed before the key is allowed to serve real traffic. Edits to the key auto-disable it until you re-test.
Rotate
Use /settings/byok-rotation to swap a key with zero downtime, or to force a re-encryption to the latest master key version.
Revoke
Removing a key disables AI calls that depend on it. With Strict BYOK on, those calls hard-fail — no silent fallback.
What gets logged
Lifecycle events
store, test, rotate, delete, strict-mode change — all written to byok_audit_events.
Runtime failures
Invalid-key responses, provider 4xx/5xx, fallback events. Visible to org admins, append-only.
Daily admin digest
A 09:00 UTC email per provider summarising failures and silent fallbacks the day before.
Member-facing toast
When a key is invalid mid-flow, members see a "Test & re-save" toast that deep-links the org admin straight to the key.
Once you've stored, tested and verified your key works for the workloads that matter. Until then, leave it off so members aren't blocked by setup gaps.
BYOK calls don't consume your Keypra credits — you pay your provider directly. Your monthly Keypra invoice covers seats and platform features only.