# Bring your own key

> Use your own model-provider credentials for an agent's model calls instead of Endue's allowance.

**Bring your own key** (BYOK) means Endue makes model calls with *your* provider credentials. The provider bills you directly, and those calls do not draw on your Endue allowance.

## When to use it

- You already have provider credit or negotiated pricing.
- Your organization requires model traffic to run under its own account for billing or audit reasons.
- You want a model that your own account has access to.

If none of those apply, the built-in allowance is simpler — there is nothing to set up and nothing to keep topped up.

## Set it up

<Steps>

1. **Create a key** in your model provider's dashboard.

2. **Open Settings → Account → LLM key** in Endue and paste it.

3. **Check that it works** by running a normal conversation and watching the run complete.

</Steps>

<Aside type="caution" title="A key is a credential">
  Anyone who can spend your key can run up a bill against it. Set a spending limit
  at the provider, and rotate the key if you suspect it has leaked. Rotating means
  creating a new key at the provider and replacing it in Endue — old and new keys
  are not interchangeable mid-run.
</Aside>

## What changes and what does not

| Changes | Stays the same |
| --- | --- |
| Who pays for model calls | Everything about how agents behave |
| Which models you can reach — your account's access applies | [Approvals](/docs/work/approvals/), [connectors](/docs/connect/overview/), [memory](/docs/capabilities/memory/), [artifacts](/docs/capabilities/artifacts/) |
| Where the bill arrives | Endue's own subscription, which still applies |

BYOK covers model calls. It does not change your Endue plan or make the product free.

## If the key stops working

A revoked, expired, or out-of-credit key makes runs fail at the model step. The symptom is a run that ends with an error before the agent does any work.

Check, in order: the key is still valid at the provider, the account has credit, and the model you selected is one your account can reach.

## Limits

- The key is set per account, not per agent.
- Runs fail if the key is invalid. There is no automatic fall back to Endue's allowance.
- Provider rate limits are yours. A busy [routine](/docs/automate/routines/) can hit them.
- Costs incurred under your own key are visible at the provider, not in Endue's usage view.

## Related

<CardGrid>
  <LinkCard
    title="Plans and usage"
    href="/docs/account/plans-and-usage/"
    description="What consumes the built-in allowance."
  />
  <LinkCard
    title="Choosing a model"
    href="/docs/build/models/"
    description="The catalog, and what each model costs to run."
  />
  <LinkCard
    title="Security and permissions"
    href="/docs/account/security/"
    description="How credentials are handled."
  />
</CardGrid>