TransIT AI
Sign up

How-tos

Bring your own provider key (BYOK)

BYOK lets you use your own Anthropic or OpenAI API key for AI agent calls instead of Transit AI’s cloud-resident key. Included free with every paid tier (Operator, Pro, Max) — no separate purchase or unlock. The BYOK tab is in Settings as soon as your subscription is active.

This page covers setting up BYOK for one or both providers.

How BYOK fits in the request path

Every AI call still goes through Transit AI Cloud — the cloud proxy is the connection layer regardless of which key it uses. What changes:

  • Your key is read from your OS keychain at request time.
  • It transits to Transit AI’s proxy infrastructure inside the request body (not a header).
  • The proxy uses your key instead of Transit AI’s to authenticate the call to Anthropic or OpenAI.
  • The key is never persisted server-side. Server-side logs contain only metadata (token counts, latency, cost) — no key bytes, no prompt, no completion.

If your BYOK key becomes invalid (rotated, expired), AI requests return an “unauthorized” error from the provider. Transit AI doesn’t silently fall back to its own key — that would surprise you with a charge you didn’t intend.

Steps — enroll a key

  1. Click your account chip in the sidebar footer.
  2. Pick Settings… from the popover.
  3. Click the BYOK tab. (If it’s not there, you’re signed out or your subscription isn’t active — BYOK requires any paid tier. On a team plan, BYOK is also free and admin-managed at the member level; see Team plans.)
  4. Pick a provider (Anthropic or OpenAI).
  5. Paste the key into the field. Keys aren’t echoed back to the UI once saved.
  6. Click Save. The key is enrolled in your OS keychain under a service name separate from your SSH credentials.

You can enroll keys for both providers — the agent picks the right one based on the chosen model.

Anthropic key format

Starts with sk-ant-…. Generate at console.anthropic.com → API Keys.

Pick a key with the scope you want — Transit AI only uses messages.create (the Messages API), so a key restricted to inference is enough.

OpenAI key format

Starts with sk-… or sk-proj-…. Generate at platform.openai.com → API Keys.

Transit AI uses chat.completions only. A project-scoped key is fine.

Steps — rotate or remove a key

To rotate: paste the new key into the same field and click Save. The OS keychain entry is overwritten.

To remove: click Clear in the BYOK tab. The keychain entry is deleted; the next AI call will fail with “BYOK key not set” until you re-enroll. (To stop using BYOK entirely and fall back to the cloud-resident key, you currently need to also flip the BYOK toggle off in Settings → BYOK; that’s wired in the same tab.)

Cost visibility with BYOK

BYOK bypasses Transit AI’s monthly budget — you pay the provider directly. Transit AI Cloud still records each BYOK call’s token counts and latency for your own usage view (/me shows totals) but the ”% of budget” indicator doesn’t apply because there’s no budget counter against a BYOK call.

You’ll see one effect on a BYOK call:

  • Cost shows as $0 in your Transit AI usage display, because the AI provider billed your own account directly. (We don’t see what the provider charged you.)

What’s never stored

  • The key itself, server-side. The desktop reads it from your keychain per request, sends it through the proxy in the request body, and forgets it after the response.
  • A copy of the key on disk anywhere outside the OS keychain.

See Security model → Cloud isolation for the full account of what the cloud does and doesn’t log.