Bring your own key

Add a provider API key on Account → AI Tools and AI calls run on your account, billed by the vendor directly. Your model choice, your provider relationship, your costs. Prefer not to manage keys? Use Pendraic Managed AI instead and top up a credit wallet from Billing.

Why BYOK

  • Direct billing. Every cent lands on the vendor invoice you already understand, at the published rate.
  • Model choice is yours. Pick whatever model your provider offers, including new releases the day they ship.
  • Privacy.Your prompts go to your provider account. Pendraic logs invocation metadata for cost accounting; we don't store the bodies.

Or use Managed AI instead

Don't want to manage keys at all? Top up a Pendraic Managed AI credit wallet on Account → Billing and we'll handle provider routing, retries, and failover for you. Usage draws down the wallet as you write. You can switch between BYOK and Managed AI any time, or use one for some projects and the other for the rest.

Supported providers

  • Anthropic, Claude models (Sonnet, Haiku, Opus).
  • OpenAI, GPT-4o, GPT-4o-mini, o1, o3 family.
  • Google, Gemini Pro, Gemini Flash family.
  • xAI, Grok models.
  • OpenRouter, aggregator across the above and more.

How keys are stored

Keys are encrypted at rest with a per-row key derivation, stored in the user_api_keys table behind row-level security. Only the server can decrypt them, and only at call time. We never expose key ciphertexts to the client.

Adding a key

Dashboard → AI Tools → API Keys. Pick a provider, paste your key. Pendraic validates it against the provider's cheapest read endpoint (e.g. /v1/models) before saving, a bad key is rejected immediately rather than silently failing on first use.

Removing a key

Same surface. Removing a key revokes it (the row stays for audit; new calls can't use it). If the revoked key was your preferred model's provider, the failover chain walks past until it finds a slot whose key is still active.