Skip to content
Consortium

Bring your own keys (BYOK)

BYOK routes agent traffic through your provider credentials. Requests go directly from your machine to the vendor — they never traverse Consortium’s proxy, are never metered, and carry no markup.

For multiple accounts per provider, OAuth sign-in, per-machine bindings, failover, and using your own account in cloud sessions, see Provider accounts.

Two kinds of credentials

Section titled “Two kinds of credentials”

Subscription accounts (OAuth). Sign in with the vendor account you already pay for — Claude, Codex (OpenAI), Gemini, or Grok — and your agent runs under that subscription:

Terminal window
consortium connect claude    # or: codex, gemini

or in the app under Settings → Connect.

Raw API keys. Add a key for any supported provider (Anthropic, OpenAI, Google, xAI, OpenRouter, Groq, DeepSeek, Mistral, and more) in the app’s provider settings. Custom providers with your own base URL are supported — useful for corporate gateways or self-hosted routers.

You can hold multiple accounts per vendor and pick one per session.

Where keys live

Section titled “Where keys live”
  • On your devices. Keys are stored in the platform secure store (device-only on iOS/Android — excluded from cloud backups) and replicated between your devices through the end-to-end-encrypted settings stream. The server cannot read them.
  • Server escrow is opt-in, per account. If you explicitly enable escrow for a credential, an encrypted copy is held server-side so managed/VPS machines can use it. Escrowed credentials are encrypted at rest but are usable by Consortium infrastructure — a different trust level than device-only storage, and the app labels it as such.

Key validation (Test connection) sends the key transiently for a single upstream probe; it is not persisted or logged.

How injection works

Section titled “How injection works”

When the daemon spawns an agent, the selected credential is injected as an environment variable into that child process only (for example ANTHROPIC_API_KEY), together with a custom base URL if the provider has one. Keys are not written into session state and never appear in message content.

Mixing planes

Section titled “Mixing planes”

BYOK and managed credits coexist: you can run Claude Code under your Anthropic subscription while another session uses managed Gemini through credits. Model pickers show which options need credits and which use your connected accounts.