Locus product guide · Updated September 29, 2026

API Key Management and BYOK for AI Agents

Locus Pro managed tools use supported provider access through your Locus account. Enterprise BYOK, or bring your own key, connects your own provider credential to custom API actions. Use managed access to reduce separate provider setup; use BYOK when you need your own supported service, provider account, or contract.

What is the difference between managed access and BYOK?

The difference is who owns the provider account. With managed access, Locus does, so you need no provider account or API key; your Locus credential controls access and your Locus balance pays. Confirm exact endpoint and model coverage in the catalog.

With a Custom API (BYOK), the upstream account and credential are yours, and the provider’s usage and data-handling terms apply. BYOK does not remove a provider subscription or make upstream calls free. You keep that credential valid and funded.

How do I add my own API with BYOK?

A workspace owner creates a Custom API provider in an Enterprise workspace with Custom APIs enabled. The owner needs recent MFA or passkey verification and the required scopes. Set a public HTTPS base URL, an authentication method, and rate, concurrency, and timeout limits.

Import OpenAPI 3.0 or 3.1 JSON or YAML, or define actions by hand. Review each action’s method, path, inputs, example, provider cost, and customer markup. Unsupported operations are reported, and imported actions start disabled. Test and enable only the actions your agents need.

How is a BYOK call billed?

A pool-funded Custom API call uses no Locus credits for provider usage; the provider bills your saved credential directly. A customer-funded call charges your configured provider cost plus markup to the end-user balance, and that charge is workspace revenue. Both paths produce receipts and activity records.

The configured provider cost is your pricing input. Locus does not measure the provider’s eventual invoice. Keep it aligned with your provider contract and check the economics on representative requests.

How do I keep provider keys away from agents?

Save the provider credential in the Custom API flow and give the agent a Locus connection with tool access, not the upstream secret. Keep tenant secret keys out of browser code and prompts. Use short-lived end-user tokens for customer-facing browser features.

Disable an action when it should stop being discoverable or callable. After a state-changing action times out, check upstream state before starting a new operation. The provider may have made the change even if the client never got the response.

Frequently asked questions

Can I import any API without changes?

No. Imports must meet the supported OpenAPI, authentication, HTTPS, operation, and schema requirements. Review unsupported operations and validate enabled actions before rollout.

Do agents see my saved provider key?

Saved upstream credentials stay private in the supported Custom API flow. Agents use their authorized Locus connection to access enabled actions.

Implementation references

Use these first-party references for current request contracts and account requirements. Tool availability, prices, and negotiated terms can change.