Bring your own model key (BYOK)

By default your agents call AI models through Qoren's own key, and that model usage is paid for in credits. With bring your own key (BYOK) you add keys for your own model provider accounts instead: your agents run on your keys and each provider bills you directly for the models they use.

You choose this per agent. Turn BYOK on for your whole organization, or leave it off and put just one agent on your own key from that agent's settings.

Before you start#

• An API key from a supported provider, with credit on that account. You can add a key for any of these:
• OpenRouter, which reaches models from many providers through one key
• Anthropic
• OpenAI
• Google Gemini
• xAI (Grok)
• DeepSeek
• Mistral
• Groq
• Custom (OpenAI-compatible): your own endpoint that speaks the OpenAI API, reached at an https base URL
• A live plan. The BYOK tab appears once your plan is active. BYOK is available on every plan, but not on free credits: before you have a plan, agents use Qoren's key.
• Owner access. The organization owner adds and removes keys, changes the default provider, and turns BYOK on or off. Anyone who can change an agent's settings can switch that agent between your keys and Qoren's.

Add a key#

1. Click your avatar, then Settings, and open the BYOK tab. Your keys lists every provider, with its key partly masked or No key.
2. Click Add key on the provider's row (1).

123

3. Paste the API key (1). The Create an API key at link (2) opens the provider's page for making one. For a custom endpoint, also enter its base URL, which must start with https://.
4. Click Save key (3).

123

Qoren checks the key with the provider and stores it encrypted. A key the provider does not accept is refused with a message, and nothing changes. Saving a key does not move any agent: that happens when you turn on BYOK, move agents, or switch one agent.

You can add keys for several providers. The one marked Default is your default provider: new agents, Custom agents and Ask Qoren run on it while BYOK is on. Click Make default on another provider's row (2) to change it.

Switch one agent to your key#

You do not need to turn on BYOK to run a single agent on your own key. Each agent chooses its own key, whether BYOK is on or off.

1. Open the agent and go to its Settings. The Model key row, under AI model, says what the agent runs on now: Qoren's managed key, or one of your keys.
2. Click Change on that row.
3. Pick Qoren's managed key or one of the providers you saved a key for (1). A Codex agent cannot pick Anthropic, Google Gemini or Mistral; see Codex agents.
4. Check the model the agent will run there (2). If the provider does not offer the agent's current model, pick one.
5. Click Switch key (3).

123

The agent switches in the background and the row says when it is done. From then on its model usage is paid to that provider, or in credits on Qoren's key. To switch it back, do the same and pick the other key. The agent must have finished setting up, and a change already running on it must finish first.

Turn on BYOK#

1. Click Turn on BYOK (3). It is available once you have saved at least one key.
2. Pick your default provider and click Continue.
3. Check the list of agents. For each one it shows what it runs on now and the model it will run at the new provider. Every agent is ticked to move; untick any that should stay where it is.

123

4. Where the provider does not offer the agent's current model, pick one from the list (1). The button stays disabled until every agent has a model.
5. If a Codex agent is listed with a reason it cannot move, choose Stop it or Use Qoren's managed key for it (2). See Codex agents below.
6. Click Turn on BYOK (3).

Qoren moves the ticked agents over in the background and switches your organization to BYOK, so new agents, Custom agents and Ask Qoren run on your default provider. The dialog then lists each agent with Moving now, the key it stays on, or the reason it could not be moved.

The tab shows On or Off, and how many of your agents run on your keys, how many are on Qoren's managed key, and how many are stopped with no key.

Move several agents at once#

Whether BYOK is on or off, you can move some or all of your agents to a provider you saved a key for, or back to Qoren's managed key.

1. Click Move agents.
2. Pick where they should run: any provider you saved a key for, or Qoren's managed key, whose model usage is billed to your credits. Click Continue.
3. Untick the agents that should stay where they are. Agents already on that provider show Already here.
4. Pick a model where needed, as when turning BYOK on, then click the Move button, which says how many agents move.

Each agent switches as soon as you confirm.

Codex agents#

Codex needs an OpenAI Responses API, which Anthropic, Google Gemini and Mistral do not offer, so a Codex agent cannot run on those providers. Their rows on the BYOK tab say Codex agents cannot run here. When you move agents to one of them, each Codex agent gets a choice instead:

• Stop it: the agent keeps its settings but runs no turns and none of its scheduled tasks (they show as paused) until you move it to a provider that runs Codex, such as OpenRouter or OpenAI.
• Use Qoren's managed key: the agent keeps running on Qoren's key, and its model usage is paid in credits.

What changes on your bill#

Model usage on your keys is not paid in credits: those model calls go to your provider account and the provider charges you for them. Agents on Qoren's managed key are paid in credits, whether BYOK is on or off.

The agent Usage tab shows no model charges for the time an agent ran on your key. For OpenClaw, Codex and OpenCode agents on a provider other than OpenRouter, Qoren does not track model usage: check it in that provider's own console.

Knowledge base embeddings stay on OpenRouter, whichever provider is your default, because stored embeddings only match the model that made them. They run on your OpenRouter key when you saved one, and otherwise on Qoren's managed key, paid in credits.

Everything Qoren runs for you still uses credits:

• Environments: the hosting for the computers your agents run on.
• Mailboxes: agent email inboxes.
• Web searches: the web searches agents make through Qoren's search service.

So your balance still matters. If it reaches zero, your agents are paused like on any plan, and they resume once credits are back. See how credits work for the full picture, and pricing for what each plan includes.

Keep an eye on your OpenRouter key#

For an OpenRouter key, the BYOK tab also shows the credit left on the key when it has a limit, and warns you when:

• OpenRouter no longer accepts the key,
• the key looks like a free-tier key, or
• the key is running low on credit.

Add credit on OpenRouter, or replace the key, so your agents do not stall mid-run.

Replace or remove a key#

• Replace key: paste the new key and click Save key. Qoren checks it, stores it, and applies it to the agents on that provider. Revoke the old key at the provider afterwards.
• Remove: deletes the key from Qoren. A key that agents still run on cannot be removed: move those agents to another key first. Removing the default provider's key makes OpenRouter the default again.

Turn off BYOK#

1. Click Turn off BYOK.
2. Check the list: every agent is ticked to move back to Qoren's managed key. Untick any agent that should stay on your own key, and pick a model for any agent whose model Qoren's key does not offer.
3. Click Turn off BYOK.

The ticked agents move back onto Qoren's key and their model usage is paid in credits again. New agents, Custom agents and Ask Qoren run on Qoren's key too. Agents you left unticked stay on your keys. Your saved keys stay saved, so you can turn BYOK on again later; remove them if you no longer want them kept.

Where the keys are kept#

Your keys are stored encrypted in your vault, each under its provider's name, such as OPENROUTER_API_KEY or ANTHROPIC_API_KEY, with a description like "OpenRouter BYOK key". Manage them from the BYOK tab rather than from the vault or the agent.