Procedure: adding your key

Requirements: a role with write permission on Settings (usually, Admin).

1. Go to Settings → Bring your own AI provider.
2. If you don’t have a key configured yet, you’ll see “No own key configured”. Click “Configure your own key”.
3. In the window, choose the Provider (OpenAI, Anthropic (Claude), Google (Gemini) or DeepSeek).
4. Paste your API key for that provider.
5. Optional — expand “Advanced options” if your provider uses a custom endpoint other than the usual one (for example, your own company deployment) and enter it there.
6. Click Save.
7. If this is the first time you’re configuring THIS provider, the platform shows you a terms notice before actually saving: read it, check the box “I have read and accept the terms above” and click Save again.

Result: your key is saved and verified right away — the platform tests it against the real provider before accepting it, so an invalid or expired key is rejected on the spot, with a clear notice, and is never saved.

Note — What the terms notice says, exactly

The notice is always the same, substituting the chosen provider’s name: “By using your own [provider] key, you’re contracting the AI service directly with [provider]: their terms of service and their data handling apply to calls made with your key from that point on. Check [provider]‘s terms in this panel’s link before continuing. Usage with your own key is never billed to or deducted from your plan; you’re directly accountable to [provider] under your own contract with them.” It’s the same text whether this is your first key or you later rotate the key of a provider you had already accepted before — in that case it isn’t asked again.

Warning — The custom endpoint only accepts public internet addresses

If you use “Advanced options” to give a custom endpoint, it has to be a public https:// address, with a full domain name (for example https://my-deployment.mycompany.com). An internal, local, or private IP address on your own network is rejected with a clear notice, and nothing is saved — neither the key nor the endpoint. This is a security check by the platform itself (it stops a key from pointing, by mistake or on purpose, at a destination on your internal network): two typical addresses of a private company deployment that would fail this check are an IP like 10.x.x.x/192.168.x.x or a name with no domain like my-internal-server. Leave it blank if your provider doesn’t need an endpoint other than the usual one — that’s the normal case for the vast majority of setups.