Guide · Updated October 8, 2026
Bring your own key (BYOK) vs hosted AI: which to choose
Bring your own key (BYOK) means an AI tool runs on your own OpenAI or Anthropic API key, and your provider bills the model use. Hosted AI costs nothing extra inside a plan's allowance, so your own key is worth a look once you run past it, or when you want the contract and limits in your name.
On this page
What bring your own key means in AI tools
With hosted AI, the vendor holds the keys, pays the provider and charges you in its own units, like credits. BYOK moves that bill to your own provider account.
Ask where the key lives and which features use it. GitHub Copilot keeps local keys on your device (GitHub docs). Cursor's custom keys cover chat models only, and tab completion stays on Cursor's own models (Cursor help).
Don't mix this up with BYOK in cloud security, where it means bring your own encryption key (AWS KMS docs). This page is about model API keys.
What BYOK costs compared with hosted AI
With hosted AI you pay one vendor. The plan comes with a monthly allowance of credits, and past it extra credits cost a published price. Ours, as an example:
| Plan | Credits included a month | Extra credits |
|---|---|---|
| Pro ($49 a month) | 25,000 | $2.00 per 1,000 |
| Studio ($149 a month) | 80,000 | $1.50 per 1,000 |
Your own key adds a second bill. Your provider charges its public token prices for every call, from the first one, and you still pay the plan price. So inside the allowance, hosted AI costs nothing extra and your own key can't win (pricing). Past it, the question is which is smaller: your extra-credit charges, or your provider's bill for that whole month's work, including the part the allowance would have covered. Compare them with your own numbers:
- Find a month when you went past the allowance. The extra credits are on their own monthly invoice.
- Get your provider's bill for a month of the same work. If you've never run it on your own key, try one month with a hard spend limit and read the provider's usage page (LLM API cost monitoring).
Our example, with made-up numbers: your invoice shows $30 of extra credits for a busy month. Your own key would only have been cheaper if your provider billed under $30 for all of that month's work.
Provider discounts and your model choice will move the numbers, so look at one to three months of real usage before you switch (our suggestion).
What else changes with your own key
| Topic | Hosted AI | Your own key |
|---|---|---|
| Data terms | The vendor's contract with its provider | Your provider's terms |
| Rate limits | Set by the vendor | Your provider account's limits |
| Model choice | The vendor picks, and can change it | You pick, if the tool supports it |
| Upkeep | None | Create the key, set limits, rotate it |
Data
With your own key, the model call runs under your provider's terms. OpenAI doesn't train on API data by default, and it keeps abuse monitoring logs for up to 30 days (OpenAI data controls). Anthropic deletes inputs and outputs from its backend within 30 days by default, though content its safety systems flag can be kept for up to 2 years (Anthropic privacy center).
The vendor still sees everything it sends, and its privacy promises may not apply on your key. Cursor's don't: its zero data retention policy doesn't cover requests on your own keys (Cursor help).
Rate limits
Your key gets your provider account's limits, and a new account starts low. On OpenAI, the Build tier, reached at $5 of purchases, has a $500 monthly usage limit (OpenAI rate limits).
Which one to pick
We'd start with hosted AI. There's no key to look after, and the plan already covers some usage. Move to your own key when one of these is true:
- You regularly go past the allowance, and your provider's bill comes in lower than the extra credits.
- You already have provider credits or a negotiated rate.
- Security or procurement wants the model contract in your company's name.
- You want a hard spend limit you control, or a specific model.
You can switch later. Once you have a month or two of real numbers, run the comparison above (our suggestion). If you switch, put your provider's usage page on your weekly operations review, and follow the LLM API cost monitoring guide.
Use your own OpenAI or Anthropic API key safely
Treat an API key like a company card, because whoever holds it can spend your money. These steps take about half an hour (our estimate).
- Give the tool its own OpenAI project or Anthropic workspace, so its usage and limits stay apart from the rest of your work. On Anthropic, make a new one, because you can't set limits on the Default Workspace (Anthropic workspaces).
- Set a hard monthly spend limit with an alert below it. We'd start at 1.5 times your expected monthly use. On OpenAI, pick "Enforce a hard limit", since an alert only notifies you, and expect spend to run a little past the line (OpenAI spend limits).
- Create the key in that project or workspace with only the permissions the tool needs, paste it into the tool's settings and run its connection test. On OpenAI, a request has to pass both the key's permission and the project role of the user behind it (OpenAI permissions). If the tool then reports no access, widen one step.
- Set an expiry and rotate on a schedule. We'd rotate every 90 days. On Anthropic you pick the expiry when you create the key, from 3 hours to 30 days or a custom length, and you can't change it later (Anthropic authentication). To rotate on OpenAI, create the new key, put it in the tool and test it, then revoke the old one (OpenAI production guide).
- Check your provider's usage page weekly for the first month (our suggestion), and revoke the key when you stop using the tool.
Keep keys out of your repositories too. GitHub secret scanning covers OpenAI and Anthropic keys, with push protection (GitHub docs). Anthropic's Console admin keys give full access to every endpoint that accepts them, with no scopes to pick (Anthropic admin keys), so only add one when a feature needs it.
Read your provider's terms on API keys before you hand one over. Anthropic's Commercial Terms make you responsible for all activity under your account (Anthropic). For OpenAI, read its business terms.
What happens when your API key fails
Keys fail, usually for boring reasons: the key expired or was revoked, you hit a spend or rate limit, or the provider is down. A spend limit comes back as an error, a 429 with project_spend_limit_exceeded on OpenAI (OpenAI), or a 400 on Anthropic when it's a limit you set (Anthropic).
A tool can handle this in two ways. It can switch to the vendor's own key and keep going, but then your data runs under the vendor's terms and on its bill, and you didn't pick that.
Or it can fail closed: the work stops and the tool tells you why. In Cursor, if a provider rejects your key, requests through that provider fail until you update or remove it (Cursor help). For work on your code, we'd want it to stop, because you chose whose terms and whose bill apply.
Before you connect a key, ask the vendor:
- Where do you store my key, and how do I remove it?
- What happens when it fails?
- Will you ever run my work on your own key without telling me, and what would you bill?
How Since handles hosted AI and your own key
Grant leads a team of AI agents, and every model call they make runs on one of two keys: ours or yours. On either, you still merge and deploy yourself; nothing merges or deploys on its own. Meet the team.
Every plan includes Since AI, counted in credits. Free gets 1,000 a month and stops there until the 1st (UTC) or an upgrade (see the plans). Pro and Studio get the allowances in the table above, and extra credits past them are billed automatically with no cap. Unused credits don't roll over.
Your own key is optional on paid plans, and it gets you a hard cap through your provider's spend limit. An owner or admin switches on "Use my own AI provider", picks a provider and runs "Test and save connection". Pro takes Anthropic or OpenAI, and Studio and Enterprise also take AWS Bedrock and any OpenAI-compatible endpoint. Your provider then bills that work, and it uses no credits. Setup is in the docs.
If a saved key breaks, Since stops and says so. It never switches to Since AI unless you tell it to. Fix the key or the spend limit, then test the connection again.
On your own key, your provider's terms cover the model calls. Since still sees the repositories and sources you connect, and we don't train models on your content (Models). We encrypt your provider key before we store it, and disconnecting removes it (What is stored).
Questions you ask Grant over MCP follow the same switch, so on your own key they use no credits either (tool reference).
Questions
What does BYOK mean in AI tools?
Bring your own key. You give the tool an API key from your own OpenAI or Anthropic account, your provider bills the model use, and the tool only bills you for itself.
Is BYOK cheaper than hosted AI?
Not inside the plan's allowance, where hosted AI costs nothing extra and your provider bills you from the first call. Past it, compare your provider's bill for the month with the extra-credit charges on your invoice. Since publishes its extra-credit price per 1,000 credits on Pro and Studio.
Is it safe to give an app my OpenAI or Anthropic API key?
Yes, if you lock the key down. Give it its own project or workspace, a hard monthly spend limit, only the permissions it needs and an expiry.
Does bringing my own key keep my data private?
Not fully. Your provider's terms cover the model call, but the tool still sees whatever it sends.
What happens when my API key stops working or hits its spend limit?
Some tools stop and tell you, like Cursor (Cursor help). Others could switch to the vendor's own key without asking, so ask first. Since stops and says so.
How do I set a spend limit on an API key?
Set it on the project or workspace that owns the key. On OpenAI, choose "Enforce a hard limit" (OpenAI). On Anthropic, use a workspace limit (Anthropic workspaces) or an organization limit on the Billing page (Anthropic limits).
Does Since use credits when I bring my own key?
No. Work on your own key is billed by your provider and uses no Since credits. Only paid plans can bring a key.
Related guides
- How to track OpenAI and Anthropic API usage and costsTrack OpenAI and Anthropic API usage and costs with what the providers already give you: usage pages, cost APIs, spend limits and a weekly LLM cost review.
- AI credits: what one costs and how to budgetAI credits are each vendor's own unit for AI use. Learn how credits differ from tokens, turn one into dollars and budget a month before you buy.
- Weekly operations review: a template for small software teamsA 30-minute weekly operations review for small software teams: the agenda, the checks for CI, AWS, security and dependencies, and a decision log to copy.