What BYOK unlocks (in plain terms)

With BYOK enabled, Nexus becomes the layer where you build and operate—and your provider account becomes the layer where you pay and govern usage.

You can now:

• Connect your own provider key to Nexus

• Run chats, agents, and workflows through your own account

• Keep costs and quotas aligned with your existing provider plan or enterprise agreement

• Scale faster with your provider’s limits instead of shared pools

• Experiment more freely by switching models/providers without changing how your team works

What’s included in the BYOK release

Here’s what you should expect from the first release of BYOK in Nexus:

1) Secure key connection + management

• Add your API key in Nexus settings

• Keys are treated as secrets (masked in the UI, designed for rotation)

2) Clear “who is using what” behavior

• Your Nexus usage routes through the key you configure (workspace-level or user-level depending on your setup)

• Provider errors (rate limit / quota) surface clearly so you can react quickly

3) Model selection stays simple

• You still pick models the same way inside Nexus—BYOK just changes whose account is used behind the scenes

Getting started in 2 minutes

1. Open Nexus → Settings → API Keys

2. Click Add Key

3. Choose your provider

4. Paste your key and Save

5. (Optional) Set a default provider/model for your workspace

After that, just use Nexus normally—your next chats and workflows will run through the configured key.

Who BYOK is for

BYOK is especially useful if you’re:

• A builder who already pays for a provider account and wants Nexus as the orchestration/UI layer

• A team that needs costs to stay inside existing procurement (startup budgets or enterprise contracts)

• A multi-model team comparing outputs across providers without rewriting tooling

• Anyone who wants “one Nexus workflow” but “many model options”

Security and governance: how we think about it

BYOK is a trust feature. Our guiding principles:

• You control the credential (add, rotate, revoke)

• Secret handling by default (keys are masked, not displayed in full after saving)

• Designed for rotation (you shouldn’t fear updating keys)

• Clear ownership (workspace admins control workspace keys; personal keys stay scoped to the user when enabled)

If you have internal details you’re ready to share (audit logs, secret manager, encryption-at-rest), this is the spot to include them. If not, keeping it principle-based is accurate and still confidence-building.

Practical tips for teams rolling out BYOK

• Start with a single workspace key for quick enablement

• Move to per-user keys if you need strict usage attribution or different provider access per user

• Set a default model so interns and new teammates don’t need to choose every time

• Document rotation ownership (“who rotates keys and when”) to avoid surprise downtime

Current limitations (so you’re not surprised)

Depending on your rollout stage, you may want to include a short “v1 limitations” section like:

• Some providers/models may still be “coming soon”

• Workspace key vs per-user key availability may depend on your plan/workspace configuration

• Advanced governance features (fine-grained routing rules, deeper usage analytics, audit exports) may be in progress

Keeping this transparent tends to reduce support load and builds trust.

What’s next

BYOK is the foundation for a more open Nexus:

• More providers

• More model routing controls

• Better usage visibility (team-level and user-level)

• Stronger governance tooling for admin teams

If Nexus is your multi-model cockpit, BYOK makes it your cockpit.

FAQ

Does BYOK mean Nexus can’t be used without a key?
Not necessarily—many teams want a hosted/quick-start option plus BYOK for control. If you offer both, say so.

Can I add multiple keys?
If supported in your build, call it out (it’s a huge win). If not yet, say it’s on the roadmap.

What if my key hits rate limits or runs out of quota?
Nexus will surface the provider error clearly so you can rotate keys, upgrade your provider plan, or switch models/providers.

Can I remove my key later?
Yes—BYOK should always be reversible.