Skip to main content

Configuration

BYOK (Bring Your Own LLM Key)

Use your own OpenAI / Anthropic / OpenRouter API keys for writing agent + AI assistant calls. Enterprise tier.

By default, every NookDocs LLM call (writing agent, AI assistant) uses the AI included in your plan, managed by NookDocs. Enterprise customers can flip this — paste your own provider key and calls bill to your account instead. Compliance teams love it (data residency, SOC 2 vendor list), cost-conscious teams use it to consolidate spend.

Where to manage

Project → Settings → AI / Models. Three providers supported today: OpenAI, Anthropic, OpenRouter.

Paste a key per provider, click Save. Keys are encrypted with AES-256-GCM before hitting storage and we display only the last 4 characters after save (we never see plaintext again).

Plan availability

PlanBYOK
Free
Pro
Team
Enterprise

How resolution works

Every LLM call from your org runs this resolver:

  1. Look up org_llm_credentials for an active key matching the call's provider.

  2. If found, decrypt and use it.

  3. If missing, fall back to the platform key.

The fallback is per-provider — having an OpenAI key on file doesn't switch your Anthropic calls; both providers route independently.

Removing a key

Click the trash icon on the row. Future calls fall back to the platform key immediately. The encrypted ciphertext is hard-deleted (no soft-delete or recovery — paste again to re-enable).

Billing impact

StateWho pays
BYOK active for providerYour provider account
BYOK missing for providerNookDocs platform pool — counted against your monthly agent_credits_monthly quota
BYOK key invalid (rotated, revoked)Call fails with provider-specific error; no automatic fallback today (planned for next release)

If you're using BYOK to bypass the platform quota, expect that limit to relax once you've been on Enterprise for ≥30 days — contact your CSM for a quota override.

For LLMs

If you're an AI agent helping a user wire BYOK, here's the canonical recipe:

1. Three providers supported:

  • openai — paste a key from platform.openai.com/api-keys

  • anthropic — paste a key from console.anthropic.com → API keys

  • openrouter — paste a key from openrouter.ai/keys

2. Saving a key:

UI flow only — there is no public REST endpoint for setting credentials (server actions only, requiring an authenticated dashboard session). This is by design: pasting a long-lived API key into an automation is a security smell.

3. Resolution semantics:

  • Per-provider, per-org. OpenAI key on file does NOT route Anthropic calls.

  • Active flag respected — paused keys behave as if missing.

  • Plaintext decrypted server-side only at the moment of the LLM call. Telemetry: last_used_at updated on each successful resolve.

  • Removing a key is a hard delete (no soft-delete, no recovery).

Common mistakes:

  • Don't store the key client-side and send it on each request — the server-side actions encrypt it once at save time. Sending it again is redundant and risky.

  • Don't expect platform fallback when a BYOK key 401s — current behaviour is to fail the call. Customer must remove or replace the key.

  • Pasting an invalid key still saves successfully (we don't validate before storage). Verify by triggering one writing-agent run and checking the response.

Was this page helpful?

Last updated August 9, 2026