**Requirements:** a role with write permission on Settings (usually, Admin). 1. Go to **Settings → Bring your own AI provider**. 2. If you don't have a key configured yet, you'll see "No own key configured". Click **"Configure your own key"**. 3. In the window, choose the **Provider** (OpenAI, Anthropic (Claude), Google (Gemini) or DeepSeek). 4. Paste your **API key** for that provider. 5. Optional — expand **"Advanced options"** if your provider uses a **custom endpoint** other than the usual one (for example, your own company deployment) and enter it there. 6. Click **Save**. 7. If this is the first time you're configuring THIS provider, the platform shows you a **terms** notice before actually saving: read it, check the box "I have read and accept the terms above" and click Save again. **Result:** your key is saved and verified right away — the platform tests it against the real provider before accepting it, so an invalid or expired key is rejected on the spot, with a clear notice, and is never saved. > **Note — What the terms notice says, exactly** > > The notice is always the same, substituting the chosen provider's name: *"By using your own [provider] key, you're contracting the AI service directly with [provider]: their terms of service and their data handling apply to calls made with your key from that point on. Check [provider]'s terms in this panel's link before continuing. Usage with your own key is never billed to or deducted from your plan; you're directly accountable to [provider] under your own contract with them."* It's the same text whether this is your first key or you later rotate the key of a provider you had already accepted before — in that case it isn't asked again. > **Warning — The custom endpoint only accepts public internet addresses** > > If you use "Advanced options" to give a custom endpoint, it has to be a **public `https://` address, with a full domain name** (for example `https://my-deployment.mycompany.com`). An internal, local, or private IP address on your own network is **rejected** with a clear notice, and nothing is saved — neither the key nor the endpoint. This is a security check by the platform itself (it stops a key from pointing, by mistake or on purpose, at a destination on your internal network): two typical addresses of a private company deployment that would fail this check are an IP like `10.x.x.x`/`192.168.x.x` or a name with no domain like `my-internal-server`. Leave it blank if your provider doesn't need an endpoint other than the usual one — that's the normal case for the vast majority of setups.