Bring your own OpenRouter API key
Use a workspace-owned OpenRouter key for AI inference.
By default, every AI inference call your workspace makes runs on the platform's OpenRouter API key. Your agents are billed for the time they run, at the per-hour rate of the model tier you chose (Frontier / Balanced / Cost-Effective) — a flat rate we publish, independent of the exact underlying model. The underlying per-token inference itself isn't charged on top of that.
If you'd rather pay OpenRouter directly for that underlying inference, you can connect your own OpenRouter key (sometimes called BYOK, "bring your own key"). Then OpenRouter charges you for the raw inference instead of us. Your per-hour runtime rate is unchanged — bringing your own key only changes who pays for the raw inference, not the tier's runtime price.
Provider keys are available to every workspace, including self-hosted Community Edition installations. In Cloud, leaving the key unset uses the managed platform key. A self-hosted administrator normally adds a key during setup.
What changes when you add your own key
| Without your key (default) | With your key (BYOK) |
|---|---|
| We pay OpenRouter for the raw inference. | You pay OpenRouter directly for the raw inference. |
| You're billed your tier's per-hour runtime rate on your monthly invoice. | Same per-hour runtime rate — we don't add an inference charge on top. |
| Your agents' time shows up under Agent Runtime on the billing page. | Same. |
Usage details are shown on the LLM analytics page regardless of which key was used. Only the billing summary changes.
Adding your key
- Go to openrouter.ai/keys and create an API key. Set a credit limit and any model restrictions you want on the OpenRouter side.
- Copy the key — it starts with
sk-or-. - In Monad, go to Settings → Workspace → Provider keys.
- Find the OpenRouter card.
- Paste your key into the field and click Save key.
Once saved, your key is stored in the same encrypted blob as the rest
of your workspace's tenant secrets — the row is encrypted at rest
using the platform's SECRETS_PHRASE, decrypted on-demand only when
an inference call needs it, and we never show the full value back to
you. The settings page only displays a masked hint of the first and
last few characters.
Most user-initiated inference paths use your key as soon as it's
saved: agent runs, thread-reply classification, document OCR and
transcription run by agents, canvas autocomplete, message
translation, semantic search, and the search reranker. A few
background paths still run on the platform key by design — the
background search indexer that runs after a file is uploaded, the
attachment text-extraction step for newly-uploaded files, and a small
number of internal embedding caches used for @mention ranking. The
LLM analytics page shows every call regardless of which key was used.
Key changes take a short moment to propagate. We cache decrypted tenant secrets in-memory for up to two minutes per server worker, so a freshly-saved or removed key can take up to ~120 seconds to apply across every worker; the worker that handles your save is updated immediately.
Replacing or removing your key
From the same Settings → Workspace → Provider keys → OpenRouter card:
- Replace swaps the saved key for a new one. Useful for rotating the key on a schedule or after a credential leak.
- Remove clears the saved key. Inference falls back to the
platform key and billing returns to
cost + surcharge.
Replace and Remove honor the same ~2-minute propagation window described above: the worker that handled your request updates immediately, others may use the previous value briefly before their local cache expires.
Who can manage the key
Only workspace administrators and owners can open Provider keys or add, replace, and remove a key.
Troubleshooting
- "OpenRouter keys must start with 'sk-or-'" — the key you pasted isn't an OpenRouter key. Generate a fresh one at openrouter.ai/keys.
- Agents stop responding right after I saved a key — your OpenRouter account may be out of credits or the key may be restricted to a model the agent isn't using. Check the OpenRouter dashboard, or remove the key to fall back to the platform key while you investigate.
- The billing summary still shows cost + surcharge — calls logged before you added the key are still billed under the previous mode. The breakdown updates as new BYOK calls are recorded; the next invoice will reflect the split.