BYOK Credentials

BYOK (Bring Your Own Keys) lets you supply your own API keys for the providers Insighto uses under the hood. When BYOK is active, those provider calls bill straight to your provider accounts — the conversation is marked billed_to = byok and neither your Insighto plan credits nor your Wallet are touched.

Use BYOK when you want to centralise your AI spend on one billing account, when you already have provider credits to burn through, or when you want to keep voice and chat working regardless of your Insighto wallet balance.

BYOK is gated by a plan feature flag. If your plan doesn't include BYOK, the master toggle is greyed out — upgrade or contact support.

What BYOK covers

Three provider slots, each independent:

Slot	Used for
OpenAI	Chat completions, embeddings, the Realtime API.
ElevenLabs	TTS voices and any custom voice clones.
Azure Speech	STT and TTS when an Azure voice / STT is selected.

What BYOK does not cover

• Deepgram STT — no BYOK slot.
• Cartesia, PlayHT TTS — no BYOK slot.
• Anthropic, DeepSeek, other LLM vendors — no BYOK slot today.
• Telephony (Twilio / Plivo / Telnyx) — always billed by the telecom carrier directly.
• Platform overhead — bundled in your Insighto plan.

If your assistant uses any provider that BYOK doesn't cover, that line item still bills against your wallet or plan credits.

Setup

1. Open Settings → BYOK Credentials.
2. For each of the three slots (OpenAI / ElevenLabs / Azure Speech), click Add to create a new provider connection. You'll be prompted for a name and the API key. For Azure Speech you'll also need the region (e.g. eastus).
3. Select the saved connection in the dropdown for each slot. All three slots must be selected before the Submit button is enabled.
4. Tick Use my keys at the top of the card — this is the master toggle.
5. Click Submit to save.

After saving, every conversation tries to resolve your BYOK keys first. If any slot is missing or the master toggle is off, that line item falls back to platform-managed keys and the Wallet picks up the cost.

Validating your keys

There's no validation when you save a key — paste a typo and it'll save fine. To verify your keys actually work, hit Check Status on the BYOK page. That makes one tiny real call per provider and returns a per-provider red/green status.

Validation issues a real billable request against each provider — small (a few tokens of LLM, a brief TTS string, a voice-list fetch), but technically billable.

Per-provider notes

OpenAI

• Standard API key starting with sk-....
• The validator hits gpt-4o-mini. If your org doesn't have access to that model, validation will fail even with a valid key — paste a key from an org that has access.
• The same key powers chat completions, embeddings, and the Realtime API.

ElevenLabs

• API key from your ElevenLabs profile.
• The validator does a small TTS call with eleven_turbo_v2_5. Make sure your plan has access to that model.

Azure Speech

• Speech key + region. Region must be the short region name (eastus, westeurope), not the display name.
• A ConnectionError from validation usually means the region is wrong.
• The same key is used for both STT and TTS depending on what you've configured per assistant.

How resolution works at runtime

The master toggle flips the deduction. With it on and all three slots populated, your wallet stays untouched. With it off, every line item bills the wallet. Mixed states are common — if your assistant uses Deepgram (no BYOK slot), only the LLM and TTS lines route to your keys; the STT line still hits the wallet.

Four business use cases

B2B SaaS — full BYOK on OpenAI. An analytics startup already has a $5,000/month OpenAI commit. They configure BYOK for OpenAI only (skipping ElevenLabs and Azure since they don't use those providers). LLM cost lands on their OpenAI bill; Insighto bills only the 2¢/min platform line on voice.

Healthcare — Azure Speech BYOK for compliance. A telehealth company is required to keep all PHI inside their Azure subscription. They configure BYOK for Azure Speech with their HIPAA-eligible Azure region. Voice audio never leaves their tenant.

Luxury concierge — ElevenLabs BYOK for voice cloning. A travel agency uses their own ElevenLabs account because their custom-cloned voice was trained on samples that contractually can't move providers. BYOK ElevenLabs keeps everything aligned.

Agency — full BYOK across all three slots. A digital-marketing agency centralises all AI spend on its own provider accounts and rebills client subaccounts with a per-minute markup. All three slots configured; agency subaccounts inherit the agency owner's BYOK by default.

Switching between BYOK and platform keys

Untick Use my keys, hit Submit, and the next conversation runs on platform keys (and the wallet path). In-flight calls finish on the keys they started with — the toggle only takes effect at session start.

Agency subaccounts and BYOK

Agency subaccounts inherit the agency owner's BYOK keys, not their own. The flow:

• If the agency's wallet-deduction toggle is off (default), subaccounts run on the agency owner's BYOK keys.
• If the agency's wallet-deduction toggle is on, subaccounts run on platform keys and the agency owner's wallet is debited.

Both the BYOK plan feature and the agency feature flag must be active on the agency owner's plan.

Troubleshooting

• Submit button stays disabled — all three slots (OpenAI / ElevenLabs / Azure Speech) must have a selection.
• "Use my keys" checkbox is greyed out — your plan doesn't include BYOK. Upgrade or add the BYOK feature.
• Conversations still deducting from Wallet — verify the master toggle is on and every slot resolves to a real key via Check Status. Any unresolved slot falls back to platform keys, and that line gets charged.
• OpenAI key invalid — most common cause: the key belongs to an org without gpt-4o-mini access. Try a key from an org that has access.

Security

Keys are stored encrypted and never returned in API responses (only the connection IDs come back). To rotate, update the connection in Settings → BYOK Credentials with the new key — no further action needed on Insighto's side.

Where to next

• Billing & Wallet — how BYOK interacts with plan credits and the wallet.
• Pricing — the line-by-line component breakdown for BYOK vs. non-BYOK.
• Voice settings — when BYOK voice zeroes the TTS line.