Bring Your Own API Key
BYOK uses your own provider account without consuming platform credits. The provider may charge according to its prices, plan or quota. Adding a key does not change IDE feature entitlements.
Configuration
- Create a dedicated provider key and set a spending limit.
- Configure the channel, actual Base URL, model name and key.
- Save and select the configuration, check the channel used by the current feature, then test a small request.
Request paths may have separate configurations. Selecting one configuration does not guarantee it covers chat, completion and every task. Compatibility, model names, thinking parameters and availability depend on the provider and current client implementation.
Storage and Data Flow
Account-linked model configuration can be stored server-side, with keys encrypted using AES-256-GCM on that storage path. Runtime calls still decrypt or transmit keys. This does not mean keys exist only locally, the frontend never handles plaintext, or all requests bypass platform components. Authorization-shard mechanisms are not a general storage guarantee for every BYOK configuration.
Requests send necessary code context to the selected model service. BYOK changes the billing account, not whether code leaves your device; provider data-handling terms apply. Check attachments, selections and project rules before sending a request to avoid including credentials in model context.
Revocation
For a suspected leak, revoke the key at the provider first, then replace or delete IDE/account configuration. Deletion may not stop an in-flight request and does not replace provider revocation.