What BYOK is and why it's workspace-scoped

BYOK (Bring Your Own Key) means Prompt Assay doesn't resell LLM tokens. Every call to Anthropic / OpenAI / Google goes out on a key you own and spend flows to your provider account. We don't mediate traffic, we don't see spend, and we don't meter usage for billing.

Getting a key from your provider

If you don't have an API key yet, follow the setup guide for your provider: Anthropic (Claude), OpenAI (GPT), or Google (Gemini). Google is the fastest starting point -- no credit card required for the free tier.

Why workspace-scoped

Keys belong to the workspace, not the user. A key added to your team workspace is used by every member of that team when they call an LLM. This is by design: billing and spend are workspace concerns, not personal ones. If two teams share a user, they get two independent sets of keys, because the same user is the caller in two different workspace contexts.

Encryption

Keys are encrypted at rest with AES-256-GCM and per-row Authenticated Additional Data (AAD) binding. Decryption happens only at call time, only in server memory, and only for the single outbound request to the provider. Keys are never written to logs, never returned via the UI after save, and never exposed to client-side code.

Tier requirement

BYOK is required for ongoing use of every tier. There is no 'platform-provided' tier · once you're past the demo budget below, every LLM call in the playground, AI pair, evaluation judge, and public API runs on your own provider account.

Demo budget for new users

New signups get a one-time, lifetime budget of 7 platform-funded calls on three AI Pair instruments (Critique, Improve, and Rewrite) so you can experience the workbench before configuring a key. Demo calls run on Claude Sonnet 4.6 regardless of your workbench-model selection.