Skip to main content

Bring your own key (BYOK)

Bring your own key (BYOK) lets your organization use its own Anthropic or OpenAI API key. When a key is set, models served by that provider run on your account instead of Delegate's — you pay the provider directly, and Delegate does not add its service fee to that usage.

Delegate still records the usage so it shows up in Usage & Spend and counts against your Budget — you keep full visibility, you just aren't billed a markup for it.

Setting a key​

BYOK keys are managed by admins under Organization → API Keys.

  1. Open Organization → API Keys (visible to admins only).
  2. In the row for Anthropic or OpenAI, paste your provider API key and choose Save.
  3. The key is validated against the provider on save. If it's accepted, it's stored securely and only its last four characters are ever shown afterwards (for example, Key configured (…a1b2)).

You can store one key per provider (one Anthropic, one OpenAI). Use Replace key to rotate it, or Remove to delete it.

note

This is different from My Settings → API Keys, which are personal keys for signing in to Delegate's own API. BYOK keys are your organization's keys for the LLM providers.

Making agents use your key​

Setting a key doesn't move existing agents onto it by itself — an agent uses your key only when the model it runs is one of your provider's models. There are two ways to get there.

Option 1 — set the agent's model explicitly​

On an agent's settings, choose one of your provider's models under Model. That agent will run on your key for every task.

Option 2 — let "System default" use it automatically​

Agents left on System default for their model can route to your key automatically, but only when the choice is unambiguous:

If your organization has a BYOK key and exactly one model for that provider is enabled (under Organization → Models), agents on System default use it.

  • Enable exactly one model for your BYOK provider. The simplest recipe is to enable only the one model you want to run and disable the rest — then every agent on System default uses it with no per-agent change.
  • If two or more of that provider's models are enabled, Delegate can't tell which one you mean, and agents on System default keep using the standard default.
  • If none are enabled, agents on System default also keep using the standard default.

Billing and budgets​

  • BYOK usage is metered — it appears in Usage & Spend and counts toward your Budget, so spending limits still protect you.
  • BYOK usage is not marked up. Delegate's service fee doesn't apply to it, because you're paying the provider directly. See Billing & plans.

What happens if the key can't be used​

If a BYOK model can't run — the key was removed, or the model was disabled for your organization — agents fall back to the standard default model where one is available, so work isn't blocked. Removing a key simply returns those agents to Delegate's platform models.

Availability of provider models​

BYOK needs at least one native Anthropic or OpenAI model to be available and enabled for your organization. Which models exist is curated by your platform operator. If Organization → Models doesn't list a model for the provider you want to use, ask your operator to add one.

For platform operators​

Native provider models are managed under Super Admin → Models:

  • Add model — create a model with the source set to anthropic or openai and the provider's exact model id (for example, claude-sonnet-4-5-20250929). The id is validated against the provider when a platform key is configured, so a mistyped or retired id is rejected at save rather than failing later.
  • Edit — fix a model's id, pricing, or context window in place. Keep ids current: providers return a not found error for retired dated snapshots, so a stale id will make BYOK tasks fail until it's updated.

Once a native model is added and enabled, an organization with a matching BYOK key can use it via either option above.

Troubleshooting​

My agent still ran on a platform model. Check, in order:

  1. Is the BYOK key set under Organization → API Keys (showing Key configured)?
  2. Is the agent on System default, or explicitly set to your provider's model? If it's on System default, is exactly one of that provider's models enabled under Organization → Models?
  3. Does Organization → Models list a native model for that provider at all? If not, your operator needs to add one.

A task failed with a "model not found" error. The model's id is out of date (often a retired dated snapshot). A platform operator can fix it under Super Admin → Models → Edit.

tip

Not sure why an agent picked the model it did? Ask any agent — it can search this documentation and walk you through BYOK setup and model selection.