BYOK

What it does

Connect an OpenAI, Anthropic, or any other supported provider's API key under Configuration → BYOK. From then on, every call to that provider made through your Mizan key uses your own credential instead of Mizan's — your own provider account is billed, and your Mizan wallet is never touched for that provider. No code change on your end: same base URL, same Mizan key, same request shape.

How it's resolved

This check runs on every single request, per provider — not per model, and not cached at the key level:

1. Does the calling key's project have its OWN connection for this provider?
   → Yes: decrypt it, call the provider with THAT key. Always wins, regardless of
           the default connection's "apply to all projects" setting below.

2. Else, is there a default (account-wide) connection for this provider, AND
   either (a) the calling key has no project, or (b) that default connection
   has "apply to all projects" turned on?
   → Yes: decrypt it, call the provider with YOUR key.
           Your own provider account is billed. Wallet untouched.

3. Otherwise: call the provider with Mizan's platform key.
   → Your Mizan wallet is debited at raw provider cost.

If a connection exists but its stored credential can't be decrypted, the call is rejected outright (a 503) rather than silently falling back to wallet billing — a broken connection should surface as an error, not a surprise charge.

Scope

A connection can be scoped to one specific project, or left as your account's default — optionally extended to cover every project via “apply to all projects”, set per connection under Configuration → BYOK.

• A project's own connection always wins over the default, even when the default has “apply to all projects” turned on.
• “Apply to all projects” only fills gaps — it never overrides a project that has configured its own connection for that provider.
• The default workspace (calls made with a key that has no project) always uses the default connection when one exists, independent of that setting.
• Scoped to the whole provider, not individual models — connecting Anthropic routes all of that scope's Anthropic calls through it.
• If more than one active connection matches at the same level (two project overrides, or two defaults), the most recently created one wins.
• Disconnecting reverts that scope's calls to the next level down — project override to default, or default to wallet billing.

Example: an account has a default OpenAI connection with “apply to all projects” on, and Project A has its own OpenAI connection. Calls from Project A use Project A's connection; calls from Project B (no override) use the default; calls from the default workspace use the default too. Turn “apply to all projects” off, and Project B's calls fall back to wallet billing instead.

Where it shows up

Every request is logged with which path served it. Analytics splits spend into platform-routed vs. BYOK; Overview sums both together as your total spend either way.

Security

Keys are encrypted at rest (AES-256-GCM) and are never returned by any API response once saved — the Configuration page only ever shows connection status, not the key itself.