> ## Documentation Index
> Fetch the complete documentation index at: https://keystroke.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed services

> Bring your own LLM provider API keys for organization-wide inference.

Managed services let your organization bring its own LLM provider API keys (BYOK). When a key is connected for a provider, every agent and workflow model call to that provider — across all projects in the organization — routes through your key instead of Keystroke's platform credentials.

Use **Settings > Managed services** in the web app to connect, rotate, and disconnect provider keys for the active organization.

<Note>
  Managed services are **not** app credentials. The [credentials system](/docs/learn/credentials/overview) (`keystroke connect`, `keystroke credentials create`) stores keys for integrations your automations call as tools — Slack, GitHub, Exa, and the rest of the apps catalog. LLM provider keys for model inference are connected here instead.
</Note>

## Supported providers

| Provider  | Slug        |
| --------- | ----------- |
| OpenAI    | `openai`    |
| Anthropic | `anthropic` |
| Google    | `google`    |
| Groq      | `groq`      |
| xAI       | `xai`       |

One key per provider per organization. Keys are encrypted at rest; after connecting, Keystroke only shows a non-secret key preview.

## How routing works

Model ids carry a vendor prefix (for example `xai/grok-4.5` or `openai/gpt-5.6-luna`). When a model call reaches the platform:

1. The vendor prefix is matched against your connected providers.
2. If a key is connected for that vendor, the request runs on your key.
3. Otherwise the request runs on Keystroke platform credentials at the platform rate.

No code changes are needed — agents and workflows keep referencing models the same way.

## Billing

Model usage on your own keys is **not billed by Keystroke** — your provider bills you directly under your own agreement. Run history still records the provider cost for reference, labeled **Your API key**, and the run's **Total billed** only includes what Keystroke charged (run fees, sandbox time, and any usage on platform keys).

Requests on platform credentials are billed at provider cost with the platform markup, and run with ZDR-only (zero data retention) routing. BYOK requests run under your provider agreement, so ZDR routing is not forced.

## Connect a provider

Connect from the web app (**Settings > Managed services**) or the CLI:

```bash theme={null}
keystroke managed-services connect xai --api-key "xai-..."
keystroke managed-services list
```

Rotate or disconnect at any time:

```bash theme={null}
keystroke managed-services update xai --api-key "xai-..."   # rotate the key
keystroke managed-services disconnect xai                   # fall back to platform keys
```

| Command                                  | Key flags         | Description                             |
| ---------------------------------------- | ----------------- | --------------------------------------- |
| `managed-services list`                  | `--kind <kind>`   | List connected provider keys            |
| `managed-services connect <provider>`    | `--api-key <key>` | Connect a provider with your API key    |
| `managed-services update <provider>`     | `--api-key <key>` | Rotate the key for a connected provider |
| `managed-services disconnect <provider>` |                   | Disconnect a provider                   |

## Permissions

| Role        | What it can do                             |
| ----------- | ------------------------------------------ |
| **Owner**   | View, connect, rotate, and disconnect keys |
| **Admin**   | View, connect, rotate, and disconnect keys |
| **Builder** | View connected providers                   |

## Next steps

<CardGroup cols={2}>
  <Card title="Billing" href="/docs/learn/settings/billing">
    Review usage and billing for the organization.
  </Card>

  <Card title="Run history" href="/docs/learn/logs/overview">
    See per-run usage, including which key source served each model call.
  </Card>

  <Card title="Credentials" href="/docs/learn/credentials/overview">
    Store integration credentials for the tools your automations call.
  </Card>

  <Card title="Build agents" href="/docs/learn/agents/build-agents">
    Configure models on your agents.
  </Card>
</CardGroup>