Bring Your Own Key

By default, Levain routes LLM calls through our own provider accounts and passes provider usage through on your Levain bill. With Bring Your Own Key (BYOK), you supply a provider key (e.g. OpenAI, Anthropic) and the provider bills you directly for model usage. Levain's platform charges still apply on top.

When BYOK is a good idea

• You already have a provider contract with committed-use pricing you want to keep using.
• Your security policy requires LLM traffic to be billed and audited through accounts you control.
• You want to use a model version or configuration that's specific to your provider account (e.g. a fine-tuned model).

Register a provider key

Post the key under the provider's slug. Levain encrypts the key at rest and only decrypts it inside the sandbox at run time.

curl -X POST https://api.levainlabs.com/api/v1/byok/anthropic \
  -H "Authorization: Bearer $LEVAIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "sk-ant-..."}'

The response returns a key_id you can use to revoke the key later. The key value itself is never returned.

List your BYOK keys

curl https://api.levainlabs.com/api/v1/byok \
  -H "Authorization: Bearer $LEVAIN_API_KEY"

This returns metadata only — provider, when the key was added, the last four characters for identification. The secret stays encrypted.

Revoke a key

curl -X DELETE https://api.levainlabs.com/api/v1/byok/$KEY_ID \
  -H "Authorization: Bearer $LEVAIN_API_KEY"

Revocation is immediate. New runs after the revocation fall back to Levain's provider accounts (unless you've registered another key for the same provider).

How routing works

When a run starts, the sandbox is provisioned with an LLM proxy. If your workspace has a valid key for the provider the agent needs, the proxy uses that key and the request hits your provider account. The provider bills you directly for that usage. Levain still records every call in the session and analytics, and continues to charge its platform fee on top.

See the full schema in the BYOK API reference.