Bring Your Own Key (BYOK) lets a workspace or organization supply its own API keys for the providers SteelEngine calls on your behalf. When a key is present, SteelEngine uses it for that provider's hosted models and knowledge base jobs instead of its own key. Agent blocks, Chat, and document processing all pick it up.
BYOK keys live in Settings → BYOK, not in Secrets or Integrations. A secret is a value you reference yourself with {{KEY}}. A BYOK key is applied automatically whenever a block calls that provider.
The workspace BYOK page appears on hosted SteelEngine only. Self-hosted deployments usually set provider keys as environment variables, and can still add organization keys under Organization Settings → Models.
Supported Providers
| Provider | Used for |
|---|---|
| OpenAI | LLM calls, speech-to-text, and knowledge base embeddings |
| Anthropic | LLM calls |
| LLM calls | |
| Mistral | LLM calls and knowledge base OCR |
| Kimi, DeepSeek, Cerebras, xAI, Fireworks | LLM calls |
| ElevenLabs, Deepgram, AssemblyAI | Speech-to-text and text-to-speech |
| Firecrawl, Exa, Serper, Linkup, Perplexity, Jina AI, Parallel AI | Web search, scraping, and research |
| Google Cloud | Translate, Maps, PageSpeed, and Books APIs |
| Brandfetch | Brand assets and company information |
| TypeSafe | Judgment block and Guardrails hallucination check (Jev). BYOK only: there is no hosted key |
The BYOK page lists every provider with a short description of what the key is used for.
TypeSafe has no hosted key, so removing it breaks every deployed workflow that uses the Judgment block or the hallucination check at its next run. Judgment state and instructions, and knowledge-base excerpts used by the hallucination check, are sent to TypeSafe (US-hosted); an organization-level key enables this for every workspace in the organization.
Self-hosting note: setting TYPESAFE_API_KEY in the host or worker environment switches these tools to a platform-key path. That path is not supported or documented in the environment contract; use BYOK.
Adding a Workspace Key
- Open workspace Settings → BYOK.
- Find the provider, or search for it with Search providers....
- Click Add Key.
- Paste your API key and click Save.
SteelEngine encrypts the key and shows only a masked version afterwards. Click Update to replace a key or Delete to remove it. Adding, updating, and deleting keys requires the workspace:manage_byok permission. Other members can see which providers have a key but cannot change them.
Organization Keys
An organization admin can add keys for the whole organization under Organization Settings → Models. An organization key applies to every workspace in the organization that has no key of its own for that provider. The workspace BYOK page shows such a key as Inherited with an Org key badge.
The same Models page holds the organization's model restrictions, described below.
How Keys Are Resolved
For each provider call, SteelEngine looks for a key in this order:
- The workspace key
- The organization key
- SteelEngine's hosted key, or the API key entered on the block
Calls made with a BYOK key are not billed to your SteelEngine usage and carry no hosted-model multiplier. You pay the provider directly at its own rates. See Costs for how hosted usage is charged.
Knowledge base processing follows the same rule. An OpenAI key is used for embeddings and a Mistral key for OCR, as described in Knowledge Base.
Scheduled Sub Agents use the same model and key resolution as Chat. A task saves its model choice, not a copy of the provider key; current keys and model restrictions are checked when it runs.
Model Restrictions
Below the provider list, Settings → BYOK shows every model SteelEngine offers, grouped by provider. Turn a model off to hide it from the workspace. A model turned off at the organization level shows Disabled by org and cannot be turned back on in the workspace. Click Save to apply your changes.
Disabled models disappear from model selectors in the workspace. A run that still names a disabled model is rejected. Changing workspace model restrictions requires the workspace:manage_settings permission. Organization restrictions are managed on Organization Settings → Models.