BYOK - bring your own key

By default, turns run on Karta’s platform model key. BYOK lets an org supply its own provider key so usage bills to your provider account and runs under your own rate limits and contracts. BYOK is a paid-plan capability; which plans include it is shown in the console. Managed plans run on the platform key and prepaid credits.

Providers

You can add multiple connectors per organization for anthropic, openai, bedrock, vertex, openrouter, xai, or google. Provider identity and API format are separate: an xAI or Google connector remains labeled as that provider even when it uses an OpenAI-compatible API. Choose a provider connector that your supported harness can use. Readiness-gated versions of Claude Code, OpenCode, DeepAgents, Goose, and Codex CLI share the same maintained model-routing contract. Each can use the current Anthropic, OpenAI, Google, and xAI frontier routes, plus a custom OpenAI-compatible endpoint and model ID. The selected harness version publishes its model-readiness status and capabilities in the harness catalog.

Custom endpoints

Set an HTTPS endpoint and explicit API format when your provider exposes an OpenAI-compatible API or you operate a compatible gateway:

echo "$XAI_API_KEY" | karta model-keys create xai production-xai \
  --key-stdin \
  --endpoint-url https://api.x.ai/v1 \
  --api-format openai_responses

echo "$COMPAT_API_KEY" | karta model-keys create openai private-models \
  --key-stdin \
  --endpoint-url https://models.example.com/v1 \
  --api-format openai_chat_completions

The endpoint must use public HTTPS and cannot contain credentials, a query string, or a fragment. Karta validates the destination again when connecting. Your prompts, tool definitions and results, and model output are sent to the selected endpoint under that provider’s terms.

Choosing models

Each key offers a set of models. Pick an org default - a key plus a model from it - on the dashboard. Every agent uses that default unless it overrides to a different key and model, so one org can route different agents to different keys. Custom model IDs are passed through as provider-owned opaque strings; they do not need to appear in Karta’s managed model catalog.

Model parameters

Organization defaults and agent overrides support the same portable controls:

Parameter	Accepted value
`temperature`	Finite number from `0` to `2`.
`top_p`	Number greater than `0` and at most `1`.
`max_output_tokens`	Positive integer, capped at `1000000`; provider/model limits may be lower.
`reasoning_effort`	`low`, `medium`, or `high` on supported OpenAI-compatible OpenAI, xAI, and Google routes.

An agent can override one field while inheriting the rest from the organization. Unsupported route or parameter combinations fail before the harness launches; Karta does not silently drop parameters or switch providers.

Anthropic subscription

Instead of an API key, you can connect an Anthropic subscription. Use it for your own coding work running on Karta - not to serve requests on behalf of your end-users, which Anthropic’s terms do not permit and which can lead to your subscription being suspended. For any agent serving users, virtual employees, backend jobs, or customers, use an API key.

Store a key

Set one from the dashboard, CLI, or management SDK:

echo "$ANTHROPIC_API_KEY" | karta model-keys create anthropic primary --key-stdin
karta model-keys list
karta agent model support-bot \
  --connector-id <id-from-list> \
  --model claude-sonnet-5 \
  --temperature 0.2 \
  --max-output-tokens 2048
karta agent model support-bot --source inherit
karta model-keys revoke <model-key-id>

import { Karta } from "@karta.sh/sdk";
const karta = new Karta({ apiKey: process.env.KARTA_API_KEY! });

await karta.modelKeys.create({
  provider: "xai",
  name: "production-xai",
  plaintext: process.env.XAI_API_KEY!,
  endpoint_url: "https://api.x.ai/v1",
  api_format: "openai_responses",
});
await karta.modelKeys.list();
await karta.modelKeys.revoke(id);

How it is used at request time

Karta resolves a connector and model once for each turn:

Selection	Result
Agent pins a connector	The agent uses that connector and its selected model.
Agent inherits from the organization	The organization default connector and model are used.
No connector is selected	The platform connector is used.
A selected connector is revoked	Turns fail until the selection is changed; Karta does not silently route them through another connector.

If a provider rejects a BYOK key, the turn surfaces a byok_key_rejected error

422 for unary requests, or an error event mid-stream for streaming requests.

Invalid or unsupported model settings return stable model_route_invalid, model_route_unsupported, or model_parameter_unsupported errors before a provider request is made.

Safety

BYOK plaintext is never logged, never put on spans, and scrubbed from error reports. Karta processes customer content to run your agent, under the operator-access policy and audit posture described in Trust.

Get started

Concepts

Agent project

The CLI

Deploy

Platform

Security

Enterprise

Tutorials

BYOK - bring your own key

Providers

Custom endpoints

Choosing models

Model parameters

Anthropic subscription

Store a key

How it is used at request time

Safety

​Providers

​Custom endpoints

​Choosing models

​Model parameters

​Anthropic subscription

​Store a key

​How it is used at request time

​Safety

Providers

Custom endpoints

Choosing models

Model parameters

Anthropic subscription

Store a key

How it is used at request time

Safety