Bring your own key | Overlane Docs

Run model calls on your own provider account by adding, testing, rotating and revoking inference keys that are stored encrypted and never shown again.

Without a key, inference runs on Overlane’s hosted models and is billed as usage. With one, the model calls run on your provider account, and bring-your-own-key inference is not billed by Overlane.

A key has an alias, a provider (anthropic, openai, google, mistral, xai or openai-compatible; the last three hold keys for models added with overlane model add), a status and a version. The alias is the only way anything refers to it: inference uses the alias, and the alias is all that appears in the API, the audit log, the logs and the screen.

Add a key

overlane enterprise keys add --alias team-anthropic --provider anthropic --value-env PROVIDER_KEY
overlane enterprise keys test team-anthropic
overlane enterprise keys list

The value is read from the environment variable you name, or from standard input. It is never a flag, so it does not land in shell history or a process listing, and --dry-run shows the request without it. The service stores it encrypted for your team only: a stored value copied to another team’s row does not open.

keys test makes a minimal call to the provider with the stored key and records the result. A key that failed its last test is not used for inference. In Enterprise settings (overlane.app/<workspace>/settings/enterprise/) the key field is a password field that is cleared the moment the key is sent.

Rotate and revoke

overlane enterprise keys rotate team-anthropic --value-env NEW_PROVIDER_KEY
overlane enterprise keys revoke team-anthropic --dry-run

Rotation checks the new value with the provider first. If the provider refuses it, the current key stays in place and keeps working. Revoking deletes the stored value, cannot be undone, and makes inference by that alias fail; revoking twice changes nothing.

Each of add, test, rotate and revoke is in the audit log with the alias and who did it, and never the value. Adding, rotating and revoking a key are in the secrets class of autonomy: an agent token needs an independent agent’s approval, a person does not.

What is checked

After a run, a scan of the database, the logs, the replies the API sent and the rendered screen finds neither the old nor the new value. The scan is proven by a planted control that it does find.

Plans

Bring-your-own-key is included from the Business plan up.