Bring Your Own Key

Bring Your Own Key (BYOK) lets you store and use your personal API keys to route messages through your own keys instead of using Pentos’s own connections. This is useful when you want better control and insight into your AI usage, or if you want to use Pentos on a free plan and still access top models from any provider.

BYOK is available on every plan, including Free, and messages and images made with your own key never cost points.

Supported Providers

Your own key works with models these providers host. The Pentos Smart Router and the models Pentos runs itself (such as GPT OSS, Gemma 4, Kimi, GLM, DeepSeek, Llama 4 Scout, Nemotron, and Granite) always use Pentos’s connection, so Use My Key is unavailable for them.

Managing API Keys

There are two ways to add and manage API keys within Pentos.

Manage in Settings

1. Open Settings and select Chats from the left sidebar.
2. Click the Keys sub-tab at the top of the page.
3. Click the add button next to the provider you want to configure.
4. Paste your API key and click Save Key.

The Keys tab shows how many times each key has been used and when it was last used. To remove a key, click the trash icon next to it and confirm.

Manage in the Model Selector

1. Open the Model Selector from the chat input area.
2. Select the provider and model you want to use.
3. Click Add API key in the right sidebar.
4. Paste your API key and click Save Key.

If a key is already saved for that provider, the sidebar shows its last four characters and a Manage button, where you can replace or remove your keys.

Using Your Key in Chats

Once a key is stored, turn on Use My Key from the chat input menu or the model selector. When enabled, your messages for that provider are routed through your own key. You can turn it on or off at any time during a conversation.

If you turn on Use My Key but have not added a key for the current provider yet, Pentos asks you to add one first.

Claude Fable 5.1 and GPT 6 Astra always run on your own key. They are marked with a key icon in the model selector, you can select them only after adding a key for their provider and turning on Use My Key, and the toggle stays on while one of them is selected. See Chat Controls for the full toggle reference.

BYOK is not supported with the Pentos Smart Router. To use your own keys, select a specific model from the model selector first.

Using Your Key for Images

Your OpenAI, Gemini, and Grok keys also work for image models: GPT Image models use your OpenAI key, Nano Banana models use your Gemini key, and Grok Imagine uses your Grok key. FLUX models always use Pentos’s connection. See Choosing an Image Model.

• In the image editor: open the image model selector, select a model, and turn on Use my API key in the right sidebar. The cost then reads Your API key instead of points.
• In chats: when a message runs on your own key, the images it creates or edits use your key for that image model’s provider too. If you haven’t added a key for that provider, the image uses Pentos’s connection and costs points as usual.

Some providers need extra setup before a key can make images. For example, OpenAI may ask you to verify your organization before your key can use its image models. If a provider refuses your key, Pentos tells you which key to check and doesn’t switch to its own connection.

Key Security

• Checked before it is saved: Pentos validates your key with the provider before storing it. A key the provider rejects is never saved.
• Stored encrypted: Your key is stored encrypted in a secure vault. Pentos only shows the last four characters afterwards, and the full key is never sent back to your browser.
• Used only for its provider: Your key is decrypted on our servers only to send your messages or image requests to that provider when Use My Key is on.
• Extra verification: If you use two-factor authentication, Pentos may ask you to verify your identity before you change your keys.
• Logged for you: Adding a key, deleting a key, and revealing a key while you type it are recorded in your security logs.

Limits

• One key per provider: Saving a new key for a provider replaces the old one.
• Validated when saved: If you later revoke a key at the provider, messages and images that use it will fail until you add a new one.