Bring your own keys

AGI Cloud never sees your API key.

Bring your own API keys to AGI Desktop, CLI, and VS Code. Each runtime holds the key in its own platform credential store, then calls the provider’s endpoint directly, so the usage lands on your provider account.

Set up a provider key Check surface availability

Desktop · CLI · VS Code
14 provider env vars
Direct provider endpoints

AGI · BYOK · your providerin 1240 · out 386 · provider billed · ctx 4%

› agi login google

Enter Google API key (GOOGLE_API_KEY):

Done! Google API key saved to the OS credential store.

› agi auth-status

Provider Type Status Expires

google api_key active -

› agi exec --provider google "explain the auth store"

One keyring entry per provider; the index holds names only.

Default · BYOK · effort:Medium · sandbox: seatbelt

Key custody

The key stays on the machine you typed it into.

There is no shared vault behind these surfaces. A key added on Desktop is unknown to the CLI, and a key added to the CLI is unknown to VS Code, because each one writes to the credential store its own platform provides.

Surface	Where the key is held
Desktop	The key is encrypted before it reaches local application storage, and saving it activates a direct-provider route in the running app without a restart.
CLI	One OS-keyring entry per provider, under the service com.agiworkforce.cli.auth. The on-disk index keeps provider names because keyrings cannot be enumerated, and it holds no key material.
VS Code	The extension hands the key to the editor’s own SecretStorage and reads it back from there.
Self-hosted	An operator sets one environment variable per provider on their own deployment. The settings screen reports whether a variable is present and never the value behind it.

The env-var contract

A provider key arrives as an environment variable.

These are the names a self-hosted deployment reads, and the CLI prompts for the key by the same name while it collects one. Presence is all that is ever reported back to a settings screen; the value stays server-side.

ANTHROPIC_API_KEYOPENAI_API_KEYGOOGLE_API_KEYXAI_API_KEYDEEPSEEK_API_KEYPERPLEXITY_API_KEYQWEN_API_KEYMOONSHOT_API_KEYZHIPU_API_KEYOPENROUTER_API_KEYGROQ_API_KEYNVIDIA_NIM_API_KEYWORKERS_AI_API_KEYVERCEL_GATEWAY_API_KEY

Surface boundary

Key entry exists where the key can stay local.

Web, Mobile, Chrome, and the managed-only Electron shell do not accept provider keys. Those surfaces have nowhere private to put a key, so they do not ask for one. Carrying an existing thread across Local, BYOK, and managed Cloud is a separate question, and the FAQ answers it.

BYOK

Route your work through the provider you already pay.

The catalog lists each provider AGI can address, how many models it exposes, how it authenticates, and the per-million-token price it publishes.

Browse the provider catalog

Availability varies by surface

AGI Cloud never sees your API key.

Desktop · CLI · VS Code

14 provider env vars

Direct provider endpoints

The key stays on the machine you typed it into.

Surface

Where the key is held

Desktop

The key is encrypted before it reaches local application storage, and saving it activates a direct-provider route in the running app without a restart.

CLI

One OS-keyring entry per provider, under the service com.agiworkforce.cli.auth. The on-disk index keeps provider names because keyrings cannot be enumerated, and it holds no key material.

VS Code

The extension hands the key to the editor’s own SecretStorage and reads it back from there.

Self-hosted

An operator sets one environment variable per provider on their own deployment. The settings screen reports whether a variable is present and never the value behind it.

A provider key arrives as an environment variable.