BYOK Provider Configuration

With BYOK (Bring Your Own Key), you add and configure each provider using your own API keys. This page describes how to set up and manage BYOK providers in Settings → Providers.

Adding a provider

1. Open Settings → Providers.
2. Find the provider you want to use (e.g. OpenAI, Azure OpenAI, OpenAI Compatible, Anthropic, Google Generative AI, Google Vertex AI, Mistral AI, SearXNG) in the BYOK list. See BYOK Providers for the full list and descriptions.
3. Enable the provider (e.g. toggle “Enabled”).
4. Enter your API key when the provider requires one. Some providers also let you set a base URL (e.g. for proxies, custom endpoints, or SearXNG). For Google Vertex AI, you must also set Project ID and Location in Provider Options, and use a service account key (JSON) as the API key.
5. Save. You can use Test connection (if available) to confirm the configuration works.

Your requests to that provider will use your key (when applicable); you are billed by the provider according to their terms.

SearXNG: After you add a SearXNG provider, open Settings → Native Tools and add that instance as a web search Tool backend (you can order it after Gateway search backends). See Web Search.

API key and base URL

• API key: Obtain it from the provider’s dashboard or developer site. Store it securely; the app masks it after saving. For Google Vertex AI, paste the full service account key (JSON) from Google Cloud. For SearXNG, an API key is optional when your instance requires one.
• Base URL: For OpenAI, OpenAI-compatible, and Azure OpenAI connections, enter the provider origin (for example https://api.openai.com). You can include or omit /v1 — both work. Leave blank to use the catalog default when we know one (OpenAI defaults to https://api.openai.com). Use a custom origin for proxies or self-hosted APIs. SearXNG always needs your instance URL.
• Google Vertex AI only: In Provider Options, set Project ID and Location (e.g. us-central1). See Google Cloud Vertex AI  for enabling the API and creating a service account.

Test connection

After saving, use Test connection to verify that the key and optional base URL work. If the test fails, check the key, base URL, and provider status.

If chat fails because the provider API key is out of credits (or rejected), the chat UI shows a toast explaining that — distinct from Steinkauz inference budget errors. Add credits in the provider’s billing settings, or switch provider/model.

Execution environment

For each provider you can set an execution environment (E0–E5). That class describes how much you trust this integration for sensitive workloads.

In chat, you separately choose Auto or Manual sensitivity policy for each thread. The server computes effective data sensitivity and checks your routing matrix against the provider’s environment before each send. See the full Data routing policy guide.

Disabling a provider

Turn the provider off in settings to stop using it. Your saved key and settings remain, but no new requests will be sent to that provider until you enable it again.

For an overview of BYOK and supported providers, see BYOK.