Your own AI API keys (BYOK) in business: what they are, why they matter and how to set them up safely

BOTrento Team4 October 20269 min read

What an API key is and how BYOK works

An API key is a long string of characters that an application uses to identify itself to a language model provider such as Anthropic Claude, OpenAI or Google Gemini. Each call to the model is linked to your account through the key and billed to that account.

You can pay for a tool that uses AI in two basic ways:

Neither option is automatically better. BYOK does, however, keep apart two costs that are otherwise bundled together: paying for the model's computation and paying for the service, meaning process set-up, integrations and oversight.

Why it matters: costs under your own control

You see actual usage

When AI runs on your account, the provider's dashboard shows how many calls were made and what they cost. You don't have to guess how much of a monthly fee goes to AI and how much to the vendor's work. This helps when you're deciding whether it's worth automating a particular process.

No markup between you and the model

A vendor that resells AI usually adds a markup to the computation price, in case you use more than expected. BYOK removes that layer. You pay the provider's own price for computation and pay the vendor for the work it actually does.

You set the budget yourself

Provider accounts usually let you track spending. Depending on the account, you may also be able to set alerts or a spending cap. Check these options when you open the account so you know what happens if usage goes up.

If you already track sales numbers every week, add the AI cost per processed enquiry. Measuring Sales: 6 KPIs a Small Business Needs to Track Every Week explains how to build that kind of weekly overview.

Data: who processes your text, and what BYOK doesn't change

With your own key, you know exactly which model provider receives the text needed for a task, and you have your own contract with that provider. Commercial API providers don't use data sent through the API to train their models. Still, read the terms for your specific account, because they can differ by account type.

Be clear about what BYOK doesn't solve. If a tool stores data on a server in the EU but also calls an external AI API, the computation isn't closed. The text needed for the task still goes to the model provider. So it makes sense to:

• send the model only what the task really needs (the text of the enquiry, not the customer's entire history),
• list the model provider in your records of processors,
• ask a lawyer to review your set-up for sensitive or unusual cases.

For a more detailed data protection checklist, see GDPR and AI in your business: a practical checklist for enquiries, quotes and sales emails.

Checklist: how to create and manage your own API keys safely

Treat an API key like the PIN for a company payment card. Anyone who has it can call the model and spend money in your company's name. Follow these steps:

1. Create a company account, not a personal one. Register the provider account with a company email, ideally a shared address, so the account doesn't leave when one employee does.
2. Set up billing and a budget. Enter your company's billing details and look at the options for spending alerts.
3. Create a separate key for each tool. Use one key for one purpose. When you stop using a tool, you revoke only its key.
4. Name each key. For example, "enquiries – pilot – October". Six months later, you'll still know what it's for.
5. Never send a key by email or chat. Enter it directly in the tool's settings. If you have to share it, use a password manager.
6. Check how the tool stores the key. The key should be stored encrypted, and the interface should show only the last few characters.
7. Appoint one person to be responsible. That person knows which keys exist, where they're used and who may change them.
8. Plan for rotation and removal. If an employee leaves, you change vendor or you suspect a leak, revoke the key and create a new one.

Before you give a key to any vendor, send them a short set of questions:

Hello,
Before we enter our own API key into your tool, we need to know:
1) how the key is stored and who on your team has access to it,
2) which texts are sent to the model provider during processing,
3) where you store our data and outputs,
4) how we remove the key and what happens to the data when our contract ends.
Thank you.

How BOTrento handles your own API keys

BOTrento Chief of Staff is a managed process for enquiries, quotes and other sales steps, and it's built on BYOK. You enter your own keys for the providers we support (Anthropic Claude, OpenAI, Google Gemini, Groq and ElevenLabs), and you pay those providers directly for AI, with no markup from us.

Your BOTrento plan covers the service: process set-up, integration with your mailbox and records, oversight, escalation and reports. The pricing page shows how plans and case capacity are structured. You get a notification when you reach 80% of capacity, and capacity is only increased with your consent.

• Keys are stored encrypted. The interface shows only the last 4 characters, and you can remove a key at any time. The help page on entering API keys has a step-by-step guide.
• We store data on servers in Germany (EU). The language model processes only the text needed for the task, through the provider you chose with your key.
• Nothing is sent without human approval. Someone on your team always approves drafts of emails and quotes.
• You start with one measured pilot with a fixed scope: 1 mailbox, 1 record system (CRM or spreadsheet) and 1 type of business case. If you stop, you receive an export of your data and outputs, a description of the processes and an agreed date for removing access and copies.

The process demo walks through how an enquiry is handled, from the incoming email to an approved draft. In our internal pilot, the process handled 35 enquiries, 18 emails, 24 quotes and 15 actions in 7 days.

When BYOK is not enough and what to watch for

Your own key settles how you pay and which provider you use. It doesn't organise the process. If each salesperson copies enquiries into a chat tool on their own, you'll see what you spend. You won't see which enquiry is waiting for a reply or who's responsible for it. ChatGPT or Claude for your business, or a managed AI process? explains the difference between a self-service chat and a managed process. If you already use a CRM, AI on top of your CRM shows how to divide the work between the CRM and AI.

Also watch out for:

• scattered accounts: several keys on employees' personal accounts that nobody knows about,
• no owner: nobody monitors spending or rotates keys,
• false assumptions about privacy: having your own key doesn't mean your text stays on your server,
• keys in spreadsheets or emails: the most common way keys end up with the wrong people.