Bring your own keys

What BYOK means here

You add your own provider API keys — OpenAI, Anthropic, Google, and xAI — and OneAI makes those models available in your catalog. The provider bills you directly for what you use. OneAI adds no markup to a key you brought, and during the v1.0 testing phase OneAI charges nothing at all.

This is the Free plan in full: the complete core workspace for one person, on your own keys. It is not a trial and it does not expire.

Where a key lives

Keys are stored encrypted on the server, under envelope encryption with per-scope keys. Two consequences are worth stating plainly because they are design rules, not implementation details:

• The browser never receives your provider key. Model calls happen server-side, inside one connector module that every request goes through. There is no path where the app in your browser talks to a provider directly — which is also what makes the policy checks and the record possible at all.
• Deletion destroys the key material. Because content and credentials are encrypted with keys scoped to your account, deleting is not a flag on a row — destroying the scope key makes the material unreadable, including in backups.

What the provider still sees

An honest caveat: with your own key, the provider necessarily knows whose key made the request. OneAI can minimize what else it learns — optional redaction of personal data during context derivation, and proxying so that as little account identity as possible is exposed — but it cannot make you anonymous to a provider you are authenticating to. Full identity separation only becomes possible with OneAI-managed credentials, which arrive with billing.

When redaction is on, the inspector shows the request after redaction, so you can verify what actually left rather than trusting a claim. And redaction is pattern matching: useful, not a guarantee. For work that must not reach a third party at all, the deterministic tool is sensitivity marking plus an allowlist — route it to a local or self-hosted model instead.

Models you host yourself

Any OpenAI-compatible HTTP endpoint can be registered as a model in your catalog, which covers Ollama, vLLM, LM Studio, llama.cpp and most self-hosted setups. Those models are free on every plan — running inference on your own hardware never consumes a usage allowance.

In the current testing phase, registering a custom endpoint is done through the API or the CLI; the in-app screen for it arrives with the node runtime, which is also what will make local model install a single command. The supported and tested local setups will be documented as part of the launch checklist.

Keys and teams

Today keys are personal. Organization-level keys — one set of credentials for a team, with a pooled budget — arrive with billing in the next release. See teams and policies for what a team can control now.

Where to do it

Key management lives in the app, not on this site. This site has no account, no settings and no key entry — deliberately (why).