Connect your own model key
Bring a key from a model provider or gateway. A successful connection needs a matching provider, endpoint, model ID, and account permission.
Gather the connection details
You need an API key from the service you plan to call, its API base URL, an available model ID, and a compatible protocol or preset. An account on a consumer chat website does not by itself provide API access or API credits.
Every plan, including Free, supports BYOK. Your provider key uses that provider’s billing and allowance, rather than OpenDesign balance.
Add the provider
- Open Settings → Models & providers → API providers.
- Choose the preset for the service that issued your key. For Custom provider, match the protocol documented by that service.
- Paste only the secret into API Key. Do not add Bearer, quotation marks, or a JSON configuration wrapper.
- Check Base URL. If a preset address is locked, use its custom-URL option before entering another endpoint.
- Choose a model from the available list, or enter the exact API model ID under Custom. Model loading depends on the service and account.
- Run Test. Read its response: a successful test verifies this small request, rather than every tool, media model or future request.
- Wait for the saved confirmation. Reopen settings to check the provider, address and model, then return to the project and select that connection before sending a small task.
Keep the key private. The field can be revealed with Show for local inspection; redact it before sharing a screenshot.
Example: DeepSeek
Create a key at DeepSeek Platform. Use https://api.deepseek.com as the base URL and choose a model your account can call. Use an ID from the provider’s current model list, such as deepseek-flash; the installed client's screenshot still contains an older preset alias. Enter the current ID as a custom model when needed. The installed 0.25.0 Get key shortcut can open the wrong provider page. Use the provider's own console instead of creating an unrelated OpenAI key.
| Field | Direct DeepSeek example |
|---|---|
| Provider / protocol | DeepSeek preset, or a compatible OpenAI-protocol custom preset |
| API Key | A key issued by your DeepSeek Platform account |
| Base URL | https://api.deepseek.com |
| Model ID | deepseek-flash, if enabled for your account |
Copy the exact ID from the current DeepSeek API documentation, rather than the display name in an old screenshot. For this OpenAI-protocol example, do not use the separate /anthropic endpoint.
Example: OpenRouter
Create a key at OpenRouter's key settings. Use https://openrouter.ai/api/v1. Copy a model ID from OpenRouter's available-model list, including its provider prefix. Do not put a direct Anthropic or OpenAI key into the OpenRouter preset. The key belongs to the gateway that receives the request.
- Choose OpenRouter in API providers and paste an OpenRouter-issued key.
- Use https://openrouter.ai/api/v1 as Base URL.
- Copy the exact model ID from the OpenRouter model directory, including the provider prefix.
- Test the connection, wait for saving, and select it in the project before running a request.
Check another provider
| Detail | What to verify |
|---|---|
| Protocol | The preset must match the documented API protocol. |
| Base URL | Use the API root expected by the preset, without a dashboard path or duplicated version segment. |
| Model | Use the API model ID, not its marketing name. |
| Permission | Confirm model access, regional availability, quota, and billing on the provider account. |
A key is not the whole execution environment
BYOK tasks still need the supported runtime that carries out the agent's file and tool operations. If the app reports that the runtime is unavailable, follow that runtime's installation or rescan instructions. Replacing the key will not install an executable.
Understand billing
BYOK requests are billed by the provider or gateway whose key you entered. An OpenDesign subscription and an external provider's balance are separate. See billing and connection troubleshooting if a valid key still cannot run a task.
Read the test result and recover
| Result | Next action |
|---|---|
| 401 / invalid key | Check the issuing service and paste the complete key without extra formatting. Replace a revoked key at its source. |
| 403 / access denied | Check model permission, region and account access with the provider. A valid secret alone does not grant model access. |
| 404 / model not found | Check the API root and exact model ID. Remove dashboard paths and duplicated /v1 segments. |
| 429 / quota or rate limit | Read the provider error to distinguish exhausted balance from a temporary rate limit. Check its account console before retrying. |
| Timeout / network error | Check whether this endpoint is reachable from the client environment. Retry a small request after resolving the network issue. |
After a successful test, send one small request in the existing project and inspect its reply and any created file. If the test passes but file operations fail, check the runtime described in the execution-environment section; do not repeatedly replace a working key.