What is BYOK?
Bring your own key: the customer's own AI provider account pays for model calls, not the vendor's markup.
BYOK — BYOK (bring your own key) is a SaaS arrangement where the customer supplies their own API key for an AI provider, so model calls are billed to the customer's account and their data is governed by their own provider agreement. It trades the vendor's markup for the customer's own contract.
Also known as: bring your own key
Why it matters
Most SaaS products that use AI charge for it through credits or a bundled plan price, marked up above the provider's own cost to cover the vendor's margin and infrastructure. BYOK removes that markup: the customer creates their own account with the AI provider, generates an API key there, and gives it to the SaaS product to use on their behalf. The provider bills the customer directly for what the product actually consumes.
BYOK also changes who governs the data sent to the model. Under a vendor-managed key, the vendor's agreement with the provider applies. Under BYOK, the customer's own contract with the provider applies, which matters for a business with specific data-handling or retention requirements. The tradeoff is that the customer now manages a key: watching its usage, rotating it if it leaks, and making sure it stays funded. A key typed into a plain settings field is a liability rather than a feature, since anyone who can read that field can read the key.
How BYOK is set up
- 1
The customer creates a provider account
With an AI provider like Anthropic or OpenAI, in their own name.
- 2
They generate an API key
Scoped to that account, from the provider's own dashboard.
- 3
They add it to the SaaS product
Into a field built to store it encrypted, not a plain settings row.
- 4
The product uses the key for model calls
Billing flows to the customer's provider account, not the vendor's.
- 5
The customer monitors and rotates the key
Using the provider's own usage dashboard and key-management tools.
The mistake to watch for
Questions
- How is BYOK different from AI credits?
- AI credits are a unit the vendor sells, priced above the provider's own cost. BYOK removes the vendor's markup entirely: the customer's own provider account is billed directly for what the product uses.
- Is BYOK more secure than a vendor-managed key?
- It depends on how the key is stored. The security benefit of BYOK is contractual, the customer's own agreement with the provider, not automatic; the key still needs to sit in a proper secrets vault either way.
- Can a customer switch between BYOK and a vendor-managed plan?
- In a well-built product, yes. The two are usually just different sources of billing for the same underlying model calls, so switching mainly means changing which account pays.