BYOK (Bring Your Own Keys)

TL;DR

• BYOK is short for Bring Your Own Keys. The customer supplies their own AI provider API credentials to FlowRunner.
• The customer pays AI providers (Anthropic, OpenAI, and others) directly for inference. FlowRunner does not take a markup.
• The same workflow can call different providers for different steps. An invoice agent can use Claude for extraction and a different model for classification within the same run.
• The provider relationship belongs to the customer. Switching providers, negotiating with them, or auditing usage happens directly between the customer and the provider, not through FlowRunner.

What it means

When an AI agent does work, it calls an AI provider to do the inference. Someone has to pay the provider for that inference. Most AI platforms include the inference cost in their pricing, either by reselling provider capacity at a markup or by bundling a fixed inference allowance into the tier.

BYOK is a different model. The customer maintains their own account with the AI provider. The customer supplies the API credentials to FlowRunner. FlowRunner uses those credentials to make calls on the customer’s behalf. The inference cost goes to the provider’s bill, not to FlowRunner’s.

Three properties follow from the model:

• No markup on inference. FlowRunner charges for the orchestration platform (tier-based pricing for workflows, executions, audit retention, and so on). FlowRunner does not charge for the AI tokens the agents consume. The customer pays the provider what the provider charges.
• Provider flexibility. A FlowRunner workflow can use any provider the customer has credentials for. A single agent can use one provider for one step and a different provider for another step, picked based on which model is best for that specific job.
• Cost transparency. The customer’s AI bill comes from the provider, line-itemed by usage. The customer can see exactly which workflows consumed which models for which work. Optimizing AI cost becomes a matter of looking at the provider’s invoice, not reverse-engineering a platform’s bundled pricing.

What it is not

BYOK is not a discount on AI. FlowRunner does not sell AI capacity; the customer buys it from providers directly. The platform fee is for orchestration, not inference.

BYOK is not a billing trick. The arrangement is operational: the agents make actual API calls using the customer’s keys, the provider records the usage against the customer’s account, the provider bills the customer. There is no obfuscation layer.

BYOK is not provider lock-in by FlowRunner. The customer’s relationship is with the AI provider. Switching providers, adding new providers, or canceling FlowRunner does not affect the underlying provider relationship.

BYOK is not the only deployment model. Customers who prefer FlowRunner to handle provider billing have that option in some tiers. BYOK is the default model because it is cleaner for cost accounting and compliance.

How FlowRunner implements it

The mechanics:

• Credential management. The customer supplies API keys for each provider they want the platform to use. The platform stores them securely and uses them to make inference calls on the customer’s behalf.
• Provider selection per workflow. Each agent or workflow specifies which provider to call for which step. The selection can be based on cost, capability, latency, or compliance.
• Multi-provider orchestration. A single agent run can call multiple providers. The platform handles the provider switching, response normalization, and any error handling needed.
• Usage records on the platform side. The platform records which workflows called which providers, for which work, in the audit trail. The provider’s invoice is the source of truth on cost; the platform’s records are the source of truth on what work was being done at the time.

The combination matters for buyers in regulated industries. Compliance and finance can look at the provider’s invoice for cost. They can look at the platform’s audit trail for what the AI was doing when the cost was incurred. The two records reconcile against each other.

Where the term comes from

BYOK is an industry term that started in SaaS, originally for security and customer-managed encryption keys. The pattern was simple: the customer holds the keys to their own data; the SaaS vendor cannot access the data without the customer’s keys.

The AI provider version of BYOK borrows the same pattern. The customer holds the API keys; the AI vendor (FlowRunner, in this case) uses the customer’s keys to call providers on the customer’s behalf. The customer retains the provider relationship, the billing relationship, and the ability to audit usage at the provider level.

What FlowRunner adds to the industry pattern is the orchestration angle. Because the platform supports multiple providers under the same set of customer keys, an agent or workflow can pick the best provider for each step. This is harder when the platform is reselling provider capacity, because the platform’s incentives push toward whichever provider it has the best margin on. With BYOK, the platform has no margin to defend. It calls the provider the workflow says to call.

BYOK is one of several deployment characteristics that distinguish Orchestration as a Service from AI-platform-plus-billing models. The orchestration platform’s job is to coordinate, govern, and supervise the AI work. The AI providers’ job is to do the inference. BYOK keeps the two roles separate.