Bring-your-own-key (BYOK)
Scenario: Your company policy requires that all LLM calls use an API key that belongs to your own Anthropic / OpenAI account so usage appears in your own billing dashboard and never routes through a third party.
Mushi supports project-scoped BYOK. When set, every classifier, judge, fix orchestrator, and intelligence-report run for that project uses your key — usage shows up in your provider console, not Mushi’s.
Setup
In the admin console: Settings → AI keys.
- Find the service’s row (Anthropic, OpenAI, OpenRouter, Cursor, Firecrawl, Browserbase or Supabase) and click Add key. You can paste
OPENAI_API_KEY=sk-…or a quoted value; Mushi strips the name and quotes. - Click Save & validate. Mushi checks the key with the provider first (a free call), then stores it in Supabase Vault. The database row keeps only the secret’s ID, and the key is never returned to the browser.
- Add more than one key for a service and Mushi moves to the next one when a key is rejected or runs out of quota.
Keys take effect on the next LLM call. No Edge Function redeploy is required. If you rotate a key, update it here — stale keys return 401 from Anthropic/OpenAI and the key shows as rejected on Settings → AI keys.
What uses the key
| Function | Model |
|---|---|
fast-filter (first look at each report) | Claude Haiku 4.5, then GPT-5.4 mini |
classify-report (diagnosis) | Claude Sonnet 5.5, then GPT-5.4 |
fix-worker (fix drafts) | Claude Sonnet 5.5, then GPT-5.4 |
judge-batch (fix grading) | Claude Sonnet 5.5, then GPT-5.4 |
intelligence-report (weekly summary) | Claude Sonnet 5.5, then GPT-5.4 |
| Search, similar bugs, codebase index | OpenAI text-embedding-3-small |
| Voice reports | OpenAI gpt-transcribe |
Your own keys are used first; when a project has none for a provider, Mushi’s platform key is used where the server has one. Set both Anthropic and OpenAI keys to keep every call on your accounts.
OpenRouter
OpenRouter has its own row. Calls that would go to OpenAI try your OpenAI keys first, then your OpenRouter keys, with OpenRouter’s model names (openai/gpt-5.4). Speech-to-text and fine-tuning stay on OpenAI, because OpenRouter does not offer them. The OpenRouter row also shows the key’s spending limit and usage, read from OpenRouter.
Audit trail
Every set / rotate / clear operation writes a row to byok_audit_log:
select actor_id, action, provider, occurred_at
from public.byok_audit_log
where project_id = 'YOUR_PROJECT_ID'
order by occurred_at desc;action is one of set, rotated, cleared.
Rotation
- Generate a new key in your provider dashboard.
- Paste it into Settings → BYOK and save.
- The old key is overwritten in Vault — the new key is active on the next LLM call.
- Revoke the old key from your provider dashboard once you confirm calls are flowing.
Langfuse trace attribution
Langfuse traces include a key_source property ('tenant' or 'platform') so you can filter your Langfuse dashboard by BYOK vs platform usage.