Bring your own key: AI agents on your account

The general model

With bring your own key, a tool calls model providers on your account instead of reselling access. You pay the provider directly, keep its usage console and choose which models are allowed. The tool's job is to store the credential safely and use it only for your work.

Which providers DevFlow accepts

Keys are stored under their standard variable names: ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY and GOOGLE_GENERATIVE_AI_API_KEY. The Google name also answers to GOOGLE_API_KEY and GEMINI_API_KEY.

A stored key overrides a same-named variable in the server environment. An OpenRouter key, however, never falls back to the server environment, so a server-level one cannot become a silent default for everyone on the server.

Where keys live

Keys belong to a workspace, not a person, and only owners manage them, under Workspace Settings → Billing → Model access. Each stored key is encrypted at rest with AES-256-GCM.

Testing a key

Owners can test a saved key, and DevFlow then calls a cheap authenticated endpoint at the provider:

• Anthropic and OpenAI: /v1/models;
• Google: /v1beta/models;
• OpenRouter: /api/v1/auth/key.

The result says whether the key was accepted. For an OpenRouter key, the remaining credit can be read as well.

How runs use the keys

Before every OpenCode run, DevFlow loads the workspace's stored keys and merges them into the run's environment. The server's own secrets are never passed to agents.

With the agent container and model relay enabled, the subprocess gets a per-run token instead of any key. The relay swaps that token for the real credential on the way out.

Plans

On the free plan, bringing your own key is the only option. Paid plans may also use managed inference, which applies only when no OpenRouter key of your own is stored.

With managed inference and no explicit spend cap, the default monthly ceiling is 100 US dollars. With your own keys and no cap set, DevFlow imposes no limit.