# Bring your own keys

Bring your own keys (BYOK) lets an agent run on a specific model from your own provider account — routed through your key, billed to you directly. The managed gateway stays the default; BYOK is the override.

## When to use BYOK

Most agents should stay Foxora-managed — you get the best model per role and tier with fallback, and one bill. Reach for BYOK when you need a specific model, an enterprise account with its own rates and data terms, or capacity Foxora doesn’t route to.

> Your usage, your ratesWith BYOK, calls go through your provider key, so Foxora bills nothing for the model — you pay the provider directly. The managed gateway above it stays the default for every other agent.

## Add a provider in Settings → Models

- 01Open Settings → ModelsGo to Settings → Models. Below the managed pools you’ll find Your providers.Your providersSettings → Models → Your providers → Add provider.
- 02Add your keyClick Add provider, pick a provider (OpenAI, Anthropic, NVIDIA, OpenRouter…), and paste your API key. The gateway routes through it — the key is held by the gateway, never by the app.

## Pin a BYOK model on an agent

In the agent editor’s Model tab, switch from Foxora-managed to Your own model. The picker lists every model from the providers you’ve connected; choose one and it’s pinned to that agent, overriding the role’s managed routing.

> Connect a provider firstIf you haven’t added a provider yet, the Model tab shows nothing to pick and offers a Connect a provider button that jumps you to Settings. Provider errors (a bad or expired key) surface inline so you can fix them.

> Treat keys like passwordsA provider key grants access to that provider’s spend. Add it only in Settings → Models, rotate it if it leaks, and remove it from Foxora when you stop using it. Foxora routes through the key; it doesn’t embed it in your agents.