Why BYOK Matters
Most AI platforms route your requests through their own provider accounts and mark up the cost — sometimes transparently, sometimes as a blended platform fee that makes it impossible to know what you actually spent on AI inference vs. platform margin.
This creates several problems:
No cost visibility. You cannot see which models cost what, how much each feature consumes, or whether your usage patterns are cost-efficient. You get a bill, not a breakdown.
No provider relationships. Enterprise deals, volume discounts, committed spend agreements — none of these apply if you are going through a middleman.
No control over routing. If the platform decides to switch model providers for cost reasons, your outputs change without your knowledge.
Vendor lock-in. Your API usage history, your rate limits, your trust tier with providers — all of it belongs to the platform, not to you.
Bring Your Own Key solves all of these.
How BYOK Works
You configure your provider API keys in your account settings. Each key is stored encrypted with AES-256-GCM in the Sentinel Vault. The platform uses your keys when routing AI requests.
You can configure keys for:
- OpenAI
- Anthropic
- Google AI Studio / Vertex AI
- Groq
- NVIDIA NIM
- OpenRouter (single key, 300+ models)
- AWS Bedrock (access key + secret)
- Azure OpenAI (endpoint + key)
- Mistral AI
- Cohere
If you have a key for a provider, the platform uses it. If you do not, the platform falls back to its own pooled keys (where available) — you are never blocked from using a feature because you have not configured a specific provider.
Per-Provider Key Management
Keys are managed at the provider level. You can:
- Add or rotate keys without disrupting running cascades
- Set a default model per provider that overrides the routing config
- Enable or disable providers — if you decide to stop using Anthropic, one toggle removes it from all routing
- View usage attribution — see which provider each cascade step used
Key rotation is zero-downtime. The new key becomes active for the next request; running requests complete with the old key.
Cost Visibility
Every cascade step that makes a model call logs:
- Which provider was used
- Which model was called
- How many tokens were consumed (input + output)
- The estimated cost at current provider rates
This data rolls up into the Sentinel financial tracking system. You can view:
- Daily/weekly/monthly AI spend broken down by provider
- Per-cascade cost attribution — which cascade configurations are most expensive
- Per-agent cost — how much each persona costs to operate
- Cost trend graphs — identify usage spikes before they hit your billing cycle
This is real cost transparency, not a dashboard that shows you your platform invoice. You are seeing provider-level token costs, in real time, attributed to specific parts of your system.
Your Provider Account Advantages
BYOK means enterprise benefits you have negotiated apply:
- Volume discounts from your direct provider contracts
- Higher rate limits from your account tier
- Priority queue access for enterprise-tier customers
- Data residency options configured at the provider level
- Compliance certifications from your provider agreement (BAA for HIPAA, etc.)
These benefits disappear when you route through a platform middleman. They are preserved when you BYOK.
What the Platform Charges For
To be clear about the model: the Sovereignty Protocol charges for the platform — the cascade runtime, the governance layer, the dashboard, the agent workforce tooling, the Spectre crawler, the storage, and the infrastructure.
It does not charge a margin on AI inference. Model API costs go directly from you to your provider. The platform is not in that transaction.
This is intentional. Platform pricing should reflect platform value. AI inference pricing should be market-rate, passed through cleanly. Mixing the two creates misaligned incentives — the platform would benefit from routing you to expensive models, and you would have no way to detect it.
BYOK keeps those incentives aligned.
Setting Up BYOK
- Navigate to Settings → API Keys → Providers
- Select the provider you want to configure
- Enter your API key (stored immediately in Sentinel Vault encryption)
- Optionally set a default model for that provider
- Test the connection
That is it. Your next cascade run will use your key.
For teams: key management supports team-level keys separate from individual keys. Your team's AI usage runs against the team key, not individual developer accounts — cleaner cost attribution, simpler key rotation.