AI provider keys
Configure bring-your-own-key credentials for text and voice providers.
Configure bring-your-own-key credentials for text and voice providers.
Bring your own key (BYOK) lets supported AI requests use your account with the AI provider. You do not need a key: the platform supplies the models by default. Saving a key requires Scale. Keys already on file keep working on Launch and Operate. You still pay the Make Agent Fast plan plus a flat platform fee per action; the provider bills its model usage directly to you.
Supported providers#
New keys can be added for two providers only — one for text and one for voice:
| Provider | Used for | Create or review a key |
|---|---|---|
| OpenRouter | Agent text generation across the models OpenRouter routes to | OpenRouter API keys |
| Speko | Speech-to-text and text-to-speech | Speko platform |
Legacy keys#
Direct vendor keys saved before the switch to OpenRouter and Speko appear under Legacy keys. They keep working until you revoke them, and you can still revoke them, but you cannot add or replace one:
| Legacy provider | Used for | Provider reference |
|---|---|---|
| Anthropic, OpenAI, Google Gemini, xAI, DeepSeek | Agent text generation | Anthropic API documentation, OpenAI API quickstart, Gemini API keys |
| Deepgram | Speech-to-text when Deepgram is the configured STT provider | Deepgram API keys |
| ElevenLabs | Text-to-speech when ElevenLabs is configured | ElevenLabs authentication |
Provider availability also depends on the platform's configured text, speech, and realtime providers. Saving a valid key does not force every feature to use that provider.
Add a provider key#
- Create a key in the OpenRouter or Speko console and enable provider billing or a spending limit if required.
- Open Dashboard → Settings → AI provider keys. Only the billing owner of a Scale workspace can save a key.
- Paste the key into the OpenRouter or Speko card.
- Select Test & save.
- Wait for the validation result, then test the feature that uses the provider.
Make Agent Fast performs a live validation request before saving a key; no model tokens or platform credits are used. The key must contain no spaces or line breaks and must be between 16 and 512 characters. OpenRouter keys must start with sk-or-; Speko keys must start with sk_speko_ or sk_live_. Live validation is authoritative.
Saving another working key for the same provider replaces the previous stored value. A key that fails validation is not saved, so the key already on file keeps working. The dashboard retains only safe identification data such as the last four characters, validation time, and state.
How text-provider selection works#
For text generation, an active OpenRouter key wins. If there is none, Make Agent Fast looks for an active legacy key matching the platform's configured text provider, then the other legacy text keys (Anthropic, OpenAI, Gemini, xAI, DeepSeek) in that order. If no suitable BYOK key exists, it uses the platform provider when the plan and deployment allow it.
Speech keys are provider-specific. A Speko key is used when speech runs through Speko. A legacy Deepgram key is used only when the active speech-to-text provider is Deepgram; a legacy ElevenLabs key is used only when text-to-speech is configured for ElevenLabs.
BYOK keys do not currently replace the platform's knowledge-embedding credentials. Knowledge ingestion and retrieval continue using the deployment's configured embedding provider.
Billing and credits#
- The external provider charges the AI token usage to the account that issued the key.
- Make Agent Fast still charges the subscription plus a flat platform fee for each action that runs on your key: 1 credit per chat reply instead of the token-based charge. The fee pays for retrieval, orchestration, and hosting around the call and is not a percentage of your token bill.
- The fee applies per provider call. Speech steps the platform funds (for example, transcription when you have only a text key) are charged at the normal rate, and live calls always use the platform rate.
- Provider quota exhaustion can fail a request even when Make Agent Fast credits remain.
Review both Usage & credits in Make Agent Fast and the provider's own usage dashboard.
Key states and failure handling#
| State | Meaning | What to do |
|---|---|---|
active | Live validation succeeded | Test the target feature and monitor provider usage |
invalid | The provider later rejected the stored key | Check provider billing, restrictions, quota, and revocation state; then save a replacement (OpenRouter or Speko) |
revoked | The key is disabled in Make Agent Fast | Save a new OpenRouter or Speko key if the feature should continue using BYOK |
If a request fails because a provider rejects the credential or quota, Make Agent Fast can mark the stored key invalid. Fixing the key at the provider does not reveal or rewrite the stored secret; for an OpenRouter or Speko key, use Test connection to recheck it, or save the working key again. A legacy key that becomes invalid cannot be replaced with another legacy key — move that provider to OpenRouter or Speko instead.
Rotate a provider key#
- Create a new provider key without deleting the old one.
- Save the new key in Make Agent Fast and confirm it becomes active.
- Test text chat or voice messages—whichever uses that provider.
- Revoke the old key in the provider console.
- Check provider logs for unexpected use of the old key.
If a key is exposed in source control or browser code, revoke it at the provider immediately. Deleting it only from Make Agent Fast does not stop another holder from using it directly with the provider.