# Bring Your Own Key Use your own API keys for hosted model and service providers Bring Your Own Key (BYOK) lets a workspace or organization supply its own API keys for the providers SteelEngine calls on your behalf. When a key is present, SteelEngine uses it for that provider's hosted models and knowledge base jobs instead of its own key. Agent blocks, Chat, and document processing all pick it up. BYOK keys live in **Settings → BYOK**, not in Secrets or Integrations. A [secret](/credentials) is a value you reference yourself with `{{KEY}}`. A BYOK key is applied automatically whenever a block calls that provider. The workspace **BYOK** page appears on hosted SteelEngine only. Self-hosted deployments usually set provider keys as [environment variables](/self-hosting/environment-variables), and can still add organization keys under **Organization Settings → Models**. ## Supported Providers | Provider | Used for | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | OpenAI | LLM calls, speech-to-text, and knowledge base embeddings | | Anthropic | LLM calls | | Google | LLM calls | | Mistral | LLM calls and knowledge base OCR | | Kimi, DeepSeek, Cerebras, xAI, Fireworks | LLM calls | | ElevenLabs, Deepgram, AssemblyAI | Speech-to-text and text-to-speech | | Firecrawl, Exa, Serper, Linkup, Perplexity, Jina AI, Parallel AI | Web search, scraping, and research | | Google Cloud | Translate, Maps, PageSpeed, and Books APIs | | Brandfetch | Brand assets and company information | | TypeSafe | Judgment block and Guardrails hallucination check (Jev). BYOK only: there is no hosted key | The **BYOK** page lists every provider with a short description of what the key is used for. TypeSafe has no hosted key, so removing it breaks every deployed workflow that uses the Judgment block or the hallucination check at its next run. Judgment state and instructions, and knowledge-base excerpts used by the hallucination check, are sent to TypeSafe (US-hosted); an organization-level key enables this for every workspace in the organization. Self-hosting note: setting `TYPESAFE_API_KEY` in the host or worker environment switches these tools to a platform-key path. That path is not supported or documented in the environment contract; use BYOK. ## Adding a Workspace Key 1. Open workspace **Settings → BYOK**. 2. Find the provider, or search for it with **Search providers...**. 3. Click **Add Key**. 4. Paste your API key and click **Save**. SteelEngine encrypts the key and shows only a masked version afterwards. Click **Update** to replace a key or **Delete** to remove it. Adding, updating, and deleting keys requires the `workspace:manage_byok` permission. Other members can see which providers have a key but cannot change them. ## Organization Keys An organization admin can add keys for the whole organization under **Organization Settings → Models**. An organization key applies to every workspace in the organization that has no key of its own for that provider. The workspace **BYOK** page shows such a key as **Inherited** with an **Org key** badge. The same **Models** page holds the organization's model restrictions, described below. ## How Keys Are Resolved For each provider call, SteelEngine looks for a key in this order: 1. The workspace key 2. The organization key 3. SteelEngine's hosted key, or the API key entered on the block Calls made with a BYOK key are not billed to your SteelEngine usage and carry no hosted-model multiplier. You pay the provider directly at its own rates. See [Costs](/execution/costs) for how hosted usage is charged. Knowledge base processing follows the same rule. An OpenAI key is used for embeddings and a Mistral key for OCR, as described in [Knowledge Base](/knowledgebase#bring-your-own-key-for-embeddings-and-ocr). Scheduled Sub Agents use the same model and key resolution as Chat. A task saves its model choice, not a copy of the provider key; current keys and model restrictions are checked when it runs. ## Model Restrictions Below the provider list, **Settings → BYOK** shows every model SteelEngine offers, grouped by provider. Turn a model off to hide it from the workspace. A model turned off at the organization level shows **Disabled by org** and cannot be turned back on in the workspace. Click **Save** to apply your changes. Disabled models disappear from model selectors in the workspace. A run that still names a disabled model is rejected. Changing workspace model restrictions requires the `workspace:manage_settings` permission. Organization restrictions are managed on **Organization Settings → Models**. ## Common Questions **Where do I add a BYOK key?** For one workspace, open Settings > BYOK. For every workspace in the organization, open Organization Settings > Models. BYOK keys are separate from the Secrets and Integrations tabs. **Which key wins when both a workspace and an organization key exist?** The workspace key. SteelEngine checks the workspace key first, then the organization key, then its own hosted key or the key entered on the block. **Does BYOK usage count against my SteelEngine usage?** No. Calls made with your own key are not recorded as SteelEngine usage and carry no hosted-model multiplier. The provider bills you directly. **Can I see a key after saving it?** No. SteelEngine encrypts the key and shows only a masked prefix and suffix. To rotate a key, click Update and paste the new value. **Is BYOK available on self-hosted SteelEngine?** The workspace BYOK page appears on hosted SteelEngine only. Self-hosted deployments usually configure provider keys through environment variables. Organization keys under Organization Settings > Models remain available.