BYOK: Bring Your Own Key

developerz.ai is a thin orchestrator. We never proxy or resell inference tokens. You connect your own API key, from any of the providers below, or from any endpoint that speaks the OpenAI API. Your key goes directly to the provider; we are not in the call path.

Why BYOK?

• Cost transparency: your provider invoice shows exactly what the agent spent. No markup, no hidden per-seat token fees.
• Model choice: pick the model that matches your cost/quality needs. Swap at any time without changing your policy file.
• Data residency: your code and issue text go directly to the provider you chose under your own account's data-handling terms.
• No vendor lock-in to us: if you stop using developerz.ai, your key and your data stay with the provider.

Supported providers

Every provider below is built in: pick it, paste the key, done. Anything else that speaks the OpenAI /chat/completions API works too, choose custom and supply the base URL. That includes self-hosted models, gateways, and providers we have not listed.

The default endpoint is what the key hits when you do not override it. You can always supply your own base URL, for a regional endpoint, a gateway, or a provider's coding-plan path.

This table is generated from the same provider table the resolver uses, so it cannot drift from what the product accepts. Model ids are not listed: they change faster than any docs page, and the dashboard's model picker is the live list.

Metered keys vs coding plans

Most keys are metered, you pay per token, and the agent's session cap bounds how much one run can spend. Two providers also sell a flat-rate coding plan, billed monthly regardless of tokens, and our own gateway is flat-rate on every path:

The path matters for the two coding plans: z.ai serves its metered API on the same host, so a key on api.z.ai/api/paas/v4 is metered while api.z.ai/api/coding/paas/v4 is the flat-rate plan. The router host is the opposite, it serves nothing but the pooled subscription, so the host alone classifies it. We classify the key from its endpoint when you add it, and a flat-rate key is exempt from the per-session cost cap below. The classification is fixed at that point, a key added against the wrong endpoint is replaced, not edited.

Adding your key

1. Open the dashboard and go to Keys (/account/keys) for keys the whole account shares, or My keys (/account/my-keys) for your own.
2. Choose your provider, paste the API key, and, for custom, or to point a built-in provider at a different endpoint, set the base URL.
3. Click Save. The key is encrypted with AES-256-GCM before being stored; the plaintext is never written to disk or logs after the initial save.
4. Verify the key. We make one cheap call to the provider to prove the credential works before any agent session depends on it.

An account holds a pool of keys, not one per provider. Each key can carry a label, a priority, and a capability tier (smart / general / fast), and the dispatcher resolves one per task, so you can run a cheap model for triage and a strong one for code, or keep a second key of the same provider as a fallback. A key can be parked (inactive) without being revoked.

Key storage and security

• Keys are stored encrypted at rest (AES-256-GCM, unique data key and IV per row).
• Keys are decrypted in memory only at the moment the agent needs to make an API call.
• No key is ever logged, included in audit events, or sent to any third-party endpoint other than the one you configured.
• Key access is scoped to your account. GitHub App installation tokens cannot read keys.
• See the security doc for the full threat model.

Spend limits

Two different limits, and the difference matters on a BYOK plan:

The per-session cap is metered from the model's own token prices as the session runs. A flat-rate coding-plan key is exempt from it, the marginal per-token cost really is zero, so there is nothing to cap.

The monthly cap bounds the metered model spend of the sessions we run for you in a window, and stops dispatching once you reach the budget you set. It is not a bill from us (under BYOK that spend is on your key, with your provider), and it cannot see spend that never went through a session, so provider-side limits are still worth setting. The per-session cap above bounds one session; this one bounds the window. Neither exists until configured: the monthly cap has no default.

When a cap is hit the agent parks the current session and logs the reason. No partial work is silently abandoned, the audit log shows exactly where the session stopped, and the work resumes automatically once the block clears.

Rotating your key

1. Generate a new key in your provider's dashboard.
2. In Keys (or My keys), open the key's Rotate action and paste the new secret.
3. Click Save. We verify the new key against the provider before swapping it in, a key the provider refuses is rejected and nothing is written, so a typo can never leave your account with a dead credential.
4. Revoke the old key in your provider's dashboard.

There is no downtime during rotation, in-flight sessions complete with the old key; new sessions use the new key. Rotation replaces the secret in place; the key's provider and billing classification are fixed when it is created, so switching provider means adding a new key rather than editing an existing one.