Bring your own OpenRouter API key
Use your own OpenRouter key to pay OpenRouter directly for inference and only get billed the platform surcharge.
By default, every AI inference call your workspace makes runs on the platform's OpenRouter API key, and your agents' inference is billed at the price of the model tier you chose (Frontier / Balanced / Cost-Effective) — a flat per-token rate we publish, independent of the exact underlying model.
If you'd rather pay OpenRouter directly, you can connect your own OpenRouter key (sometimes called BYOK, "bring your own key"). Then OpenRouter charges you for the raw inference and Monad bills only its margin on top — i.e. the tier price minus what you already paid OpenRouter (never less than $0).
Bringing your own key is an Enterprise feature. On the Plus and Pro plans, agents always run on our key — the key fields appear only for Enterprise workspaces. If your workspace leaves Enterprise, any key you added is removed automatically.
What changes when you add your own key
| Without your key (default) | With your key (BYOK) |
|---|---|
| We pay OpenRouter. | You pay OpenRouter directly. |
| You're billed the model tier price on your monthly invoice. | OpenRouter bills you the raw cost; we bill only our margin (tier price − raw cost, never below $0). |
| Inference usage shows up under AI Usage on the billing page. | Same — but only the margin portion is billed by us. |
Usage details are shown on the LLM analytics page regardless of which key was used. Only the billing summary changes.
Adding your key
- Go to openrouter.ai/keys and create an API key. Set a credit limit and any model restrictions you want on the OpenRouter side.
- Copy the key — it starts with
sk-or-. - In Monad, go to Settings → Billing.
- Find the AI inference key card.
- Paste your key into the field and click Save key.
Once saved, your key is stored in the same encrypted blob as the rest
of your workspace's tenant secrets — the row is encrypted at rest
using the platform's SECRETS_PHRASE, decrypted on-demand only when
an inference call needs it, and we never show the full value back to
you. The settings page only displays a masked hint of the first and
last few characters.
Most user-initiated inference paths use your key as soon as it's
saved: agent runs, thread-reply classification, document OCR and
transcription run by agents, canvas autocomplete, message
translation, semantic search, and the search reranker. A few
background paths still run on the platform key by design — the
background search indexer that runs after a file is uploaded, the
attachment text-extraction step for newly-uploaded files, and a small
number of internal embedding caches used for @mention ranking. The
LLM analytics page shows every call regardless of which key was used.
Key changes take a short moment to propagate. We cache decrypted tenant secrets in-memory for up to two minutes per server worker, so a freshly-saved or removed key can take up to ~120 seconds to apply across every worker; the worker that handles your save is updated immediately.
Replacing or removing your key
From the same Settings → Billing → AI inference key card:
- Replace swaps the saved key for a new one. Useful for rotating the key on a schedule or after a credential leak.
- Remove clears the saved key. Inference falls back to the
platform key and billing returns to
cost + surcharge.
Replace and Remove honor the same ~2-minute propagation window described above: the worker that handled your request updates immediately, others may use the previous value briefly before their local cache expires.
Who can manage the key
Only workspace members with the Manage billing permission see the input field. Other members see whether a key is configured (and the masked hint) but can't change it. The same role gate covers the Replace and Remove buttons.
Troubleshooting
- "OpenRouter keys must start with 'sk-or-'" — the key you pasted isn't an OpenRouter key. Generate a fresh one at openrouter.ai/keys.
- Agents stop responding right after I saved a key — your OpenRouter account may be out of credits or the key may be restricted to a model the agent isn't using. Check the OpenRouter dashboard, or remove the key to fall back to the platform key while you investigate.
- The billing summary still shows cost + surcharge — calls logged before you added the key are still billed under the previous mode. The breakdown updates as new BYOK calls are recorded; the next invoice will reflect the split.