Skip to content
← Browse docs
Working with the agent

Bring your own keys (BYOK)

Add your own provider API key in Settings → Provider keys and the agent calls that provider directly from your browser. Keys stay on your device unless you choose to save them, end-to-end encrypted, to your account.

Supported providers #

  • Anthropic (Claude models)
  • OpenAI (GPT models)
  • Google (Gemini models)
  • Fireworks AI (Kimi, DeepSeek, GLM, Llama and other open-source models)

Setup #

  1. Open Settings → Provider keys.

    Keys for every supported provider are managed in one place.

  2. Paste your API key for a provider.

    Anthropic, OpenAI, Google, or Fireworks. The key is stored on this device straight away.

  3. Choose whether to keep it on this device or save it to your account.

    Saving to your account makes the key available on your other devices; it is end-to-end encrypted with your login password.

  4. Optionally set model routing.

    Model routing chooses the provider and model used for each agent role — for example a stronger model for the lead and a faster one for helpers.

  5. Choose "Your key" in the agent panel.

    The route chip at the top of the agent panel switches the agent to your key. It shows the lead model while your key is in use.

How key storage works #

  • By default keys are stored in your browser, encrypted at rest, and persist across sessions on that device.
  • If you choose Save to my account, the key is end-to-end encrypted with your login password before it leaves the browser, and becomes available when you sign in on another device. Removing it from your account removes the saved copy.
  • Your organisation can supply a shared provider key instead. Once you unlock it with the organisation passphrase, the agent uses the organisation key rather than your own.

Practical notes #

  • Each provider has its own stored key — adding one doesn't clear the others.
  • For Fireworks you can set a preferred region.
  • If you have no key saved and your plan includes the hosted agent, Recense starts you on Hosted once; after that it keeps whichever route you choose.

Next steps