BYOK (“bring your own key”) lets your workspace route AI analysis through API keys you control—instead of only using PingChange-hosted models. That includes change summaries, alert filtering, and preview-time AI where your plan includes those features.
Keys are encrypted at rest. The dashboard only shows a redacted value (for example sk-…xxxx); the full secret is never displayed again after save.
Open BYOK settings
- Go to Dashboard → Settings.
- Select API keys in the sidebar.
- Scroll to AI analysis (BYOK) below the workspace API key card.
Add a credential
- Click Add credential.
- Choose a Provider — OpenAI, Anthropic, Google, OpenRouter, or xAI.
- Choose a Model from the curated list for that provider (flagship and lighter “mini” options per vendor; OpenRouter uses cross-provider model slugs).
- Paste your provider API key (minimum length enforced on save).
- Optionally turn on Set as active credential so this key is used immediately.
- Click Save.
Only one credential is active per workspace at a time. Activating a key deactivates the others.
Manage existing credentials
Each saved credential shows provider, model, redacted key, and Active / Inactive status.
| Action | When to use it |
|---|---|
| Set active | Switch AI routing to an inactive credential without re-entering the secret. |
| Edit | Change provider, model, or active flag; paste a new API key only if you want to replace the stored secret (leave blank to keep the current key). |
| Delete | Remove a credential permanently. Other credentials or default routing may apply if none remain. |
Supported providers
The product UI offers these providers (each with a fixed set of models in the dropdown):
- OpenAI — direct API (for example GPT-5.5 and GPT-5.4 mini).
- Anthropic — direct API (Claude Sonnet and Haiku variants).
- Google — Gemini Pro and Flash “latest” models.
- OpenRouter — multi-vendor slugs (OpenAI, Anthropic, and Google models through one key).
- xAI — Grok flagship and fast mini tiers.
Exact model labels match what you see in Add credential; PingChange does not accept arbitrary model strings outside that list.
How BYOK relates to monitoring
BYOK does not replace the workspace API key. RSS and MCP still use the workspace key from the card above BYOK.
BYOK only affects AI-powered product behavior—such as plain-language summaries on diffs and AI-assisted alert triggers described in AI-assisted monitoring. If no BYOK credential is active, paid features use PingChange’s default AI routing for your plan.