Bring your own provider key (BYOK)

BYOK lets you use your own Anthropic or OpenAI API key for AI agent calls instead of Transit AI’s cloud-resident key. Available on Pro and Max tiers as a $100 one-time unlock — a single purchase attaches the entitlement to your subscription for as long as you remain subscribed. After the unlock completes, the BYOK tab appears in Settings and you can enroll one or both provider keys.

This page covers setting up BYOK for one or both providers, assuming the unlock is already in place.

How BYOK fits in the request path

Every AI call still goes through api.transitai.app — the cloud proxy is the connection layer regardless of which key it uses. What changes:

• Your key is read from your OS keychain at request time.
• It’s sent to the cloud proxy as a request-body field (not a header).
• The proxy strips the field before forwarding to Anthropic or OpenAI, and uses your key instead of the cloud-resident one.
• The key is never persisted server-side. The cloud’s logs contain only metadata (token counts, latency, cost) — no key bytes, no prompt, no completion.

If your BYOK key becomes invalid (rotated, expired), AI requests return an “unauthorized” error from the provider. Transit AI doesn’t silently fall back to the cloud-resident key — that would surprise you with a charge you didn’t intend.

Steps — enroll a key

1. Click your account chip in the sidebar footer.
2. Pick Settings… from the popover.
3. Click the BYOK tab. (If it’s not there, you’re on the Operator tier — BYOK isn’t included on Operator — or you haven’t purchased the $100 unlock yet on a Pro or Max subscription. See Pricing FAQ.)
4. Pick a provider (Anthropic or OpenAI).
5. Paste the key into the field. Keys aren’t echoed back to the UI once saved.
6. Click Save. The key is enrolled in your OS keychain under a service name separate from your SSH credentials.

You can enroll keys for both providers — the agent picks the right one based on the chosen model.

Anthropic key format

Starts with sk-ant-…. Generate at console.anthropic.com → API Keys.

Pick a key with the scope you want — Transit AI only uses messages.create (the Messages API), so a key restricted to inference is enough.

OpenAI key format

Starts with sk-… or sk-proj-…. Generate at platform.openai.com → API Keys.

Transit AI uses chat.completions only. A project-scoped key is fine.

Steps — rotate or remove a key

To rotate: paste the new key into the same field and click Save. The OS keychain entry is overwritten.

To remove: click Clear in the BYOK tab. The keychain entry is deleted; the next AI call will fail with “BYOK key not set” until you re-enroll. (To stop using BYOK entirely and fall back to the cloud-resident key, you currently need to also flip the BYOK toggle off in Settings → BYOK; that’s wired in the same tab.)

Cost visibility with BYOK

BYOK bypasses Transit AI’s monthly budget — you pay the provider directly. Transit AI Cloud still records each BYOK call’s token counts and latency for your own usage view (/me shows totals) but the ”% of budget” indicator doesn’t apply because there’s no budget counter against a BYOK call.

You’ll see two things on a BYOK call’s metadata:

• byok: true in the proxy’s per-call log.
• Cost shows as $0 in your Transit AI usage display (we don’t see what the provider charged you).

What’s never stored

• The key itself, server-side. The desktop reads it from your keychain per request, sends it through the proxy in the request body, and forgets it after the response.
• A copy of the key on disk anywhere outside the OS keychain.

See Security model → Cloud isolation for the full account of what the cloud does and doesn’t log.