BYOK
Bring your own keys for hosted and local AI model providers.
BYOK (bring your own key) lets you connect your own AI provider credentials so that agents, utility AI blocks, and the Workflow Copilot run on your accounts. Confluye stores each credential encrypted and never logs key material.
Supported providers
Hosted, OpenAI-compatible, and local providers are all configured from the same catalog. Each entry has a default model, a credential name, and a model list.
| Provider | Credential | Notes |
|---|---|---|
| OpenAI | OPENAI_API_KEY | GPT models, embeddings, vision, image, STT/TTS |
| Anthropic | ANTHROPIC_API_KEY | Claude models |
| Gemini (Google) | GOOGLE_AI_API_KEY | Multimodal models |
| Azure OpenAI | AZURE_OPENAI_API_KEY | Deployments with API-version control |
| OpenRouter | OPENROUTER_API_KEY | Routes across many hosted providers |
| DeepSeek, Mistral, Groq, Perplexity, Together, Fireworks, xAI, Cohere | per-provider key | OpenAI-compatible endpoints |
| Custom | CUSTOM_AI_API_KEY | Any OpenAI-compatible proxy or gateway |
| Ollama (local) | optional | Self-hosted, with model discovery |
| vLLM (local) | optional | Self-hosted, with model discovery |
Adding provider keys
Open the provider catalog, pick a provider, and paste your key. Most providers also accept a
custom baseUrl (and Azure an API version). You can run a live test to confirm the credential
before saving.
Selecting a provider and model
For Google Gemini, add the Gemini block from the workflow catalog and select your Gemini
workspace credential. New Gemini configurations start with gemini-3.8-flash; existing saved
model choices are preserved. The node's Google Gemini provider uses an API key, separate
from Google Workspace's OAuth connection. See the Gemini block
for setup and Workspace data-use requirements.
AI blocks reference a provider, a model, and a credential template such as {{OPENAI_API_KEY}}
directly in their configuration — so different blocks in the same workflow can use different
providers and models. The resolved model is validated at configure time against the effective
model list.
Disabling models
Two layers can block a model:
- Organization-locked models are disabled org-wide and can't be re-enabled per workspace.
- Workspace-disabled models let a workspace turn off specific models.
A model disabled by either layer is refused wherever a block tries to use it, keeping model policy consistent across the workspace.
Local providers (Ollama & vLLM)
Ollama and vLLM connect to a self-hosted, OpenAI-compatible server. They require a baseUrl and
do not require an API key.
| Provider | Default base URL | Discovery endpoint |
|---|---|---|
| Ollama | http://localhost:11434/v1 | GET {origin}/api/tags → model names |
| vLLM | http://localhost:8000/v1 | GET {origin}/v1/models → model ids |
- 1
Set the base URL
Enter the server's base URL. Only
http/httpsschemes are accepted; loopback and private hosts are allowed because that's the legitimate local-server case. - 2
Discover models
Confluye queries the discovery endpoint (short timeout, cached ~60s) and populates the model list from the server's advertised models.
- 3
Use in a workflow
Point an Agent (or any AI block) at the local provider and one of the discovered models.
AI blocks that use BYOK
Your keys power more than the Agent block. The utility AI blocks — Embeddings, Vision, Image Generator, Speech-to-Text, Text-to-Speech, Translate, and Web Search — all run through BYOK, and the A2A block uses a workspace API key to call external agents.
For voice input, OpenAI uses gpt-4o-mini-transcribe; Groq, Azure OpenAI, and custom compatible
providers keep their provider-specific transcription model mapping. Audio is sent directly from the
server to the provider with a 60-second and 10 MB limit. Usage records include workspace, provider,
model, verified duration, latency, status, and provider request ID when available, but never audio or
transcript content.