What is BYOK for AI chatbots, and what does it really cost?

BYOK for AI chatbots, defined precisely

BYOK for AI chatbots has a narrow meaning. The “key” is an API key: a secret string that identifies your account at a model provider such as Anthropic, OpenAI or Google and authorises requests that are billed to it. In a BYOK chatbot you create that key and give it to the platform, and the platform uses it to call the provider whenever a visitor writes a message. A product is BYOK when all three of these are true:

• The key belongs to an account you own, with your own usage dashboard and invoice at the provider.
• The platform calls the provider with that key. It does not route your traffic through its own account and then bill you for the result.
• You can revoke the key at the provider at any moment, which immediately stops the platform from spending in your name.

A consumer subscription is not a key. A ChatGPT or Claude chat subscription does not include API access; API usage is a separate account with its own credit and its own invoice. Our AI keys overview explains how this works in practice, and the BYOK AI chatbot page shows the setup on SiteTrellis.

Follow one message: where the money goes

The easiest way to see what BYOK changes is to follow a single visitor message through the system.

1. The visitor types a question into the widget on your website.
2. The platform assembles a request: your instructions, your pasted knowledge, the recent conversation and the new message.
3. The platform sends the request to the provider with your key.
4. The provider writes a reply and counts the tokens it read (input) and wrote (output) against your account.
5. The platform shows the reply to the visitor. Your provider adds the usage to your next invoice or draws it from your prepaid balance.

That produces two separate bills with two separate meters:

Because the provider bills you directly, the platform has nothing to mark up. Whether it adds a fee for AI usage is something you can verify: compare your provider’s invoice with what the platform claims.

BYOK is not “bring your own model” and not reselling

Three different things get described with similar words, and the differences matter when you compare vendors.

Reselling is not dishonest. A vendor can bundle AI and give you one simple invoice, which many teams prefer. The question is whether you can see the margin. BYOK also differs from running your own model: SiteTrellis connects to the hosted APIs of five providers with your key, and it does not host or fine-tune models for you.

The trade-offs: what BYOK costs you besides money

BYOK moves work and responsibility from the vendor to you. Weigh these honestly before choosing it.

• A setup tax. You need a provider account, billing details, a key and ideally a spend limit before the first reply. It takes minutes, but it is one more account to maintain.
• You hold the credit. If a prepaid balance runs out, replies stop. A second model on another provider as a fallback covers this; see why one provider is a single point of failure.
• The provider’s limits are your limits. New accounts often start with low rate limits. A burst of visitors can hit a 429 response that a managed vendor would absorb.
• Two invoices. Reconciling a platform plan and a token bill is more work than one line item.
• Split support. When something fails, you may need to tell whether the platform or the provider is at fault. Good platforms show the provider’s error message in the dashboard.
• The data terms are yours to read. The provider receives the text needed to answer. Check its retention and training terms and mention them in your privacy policy.

In return you get a readable cost, a free choice of model and an agreement with the provider that you negotiate yourself. If you prefer one invoice and no token vocabulary, a bundled product is a reasonable choice, and the alternatives pages compare several.

Key security basics for a BYOK chatbot

An API key is a spending credential. Treat it like a company card number.

• One dedicated key per purpose. Create a key just for the chatbot, labelled so you recognise it. If it leaks or misbehaves you can revoke it without breaking anything else.
• A monthly spend limit at the provider. This is the hard backstop behind any platform rate limit. Set it before you publish.
• Rotate on a schedule and after any doubt. Create the new key first, swap it in, test, then revoke the old one. On SiteTrellis, rotating replaces the secret and agents keep working.
• Never in client-side code. Anything in your page’s JavaScript, HTML or a public repository can be read by visitors and scraped by bots. The platform must keep the key on the server.
• Keep your own copy in a password manager. Most platforms, ours included, show a key only as a short hint after saving.
• Limit who can manage keys. Admin-level roles only, and remove people when they leave.

// Wrong: this ships to every visitor's browser
const API_KEY = "sk-example-do-not-do-this";
fetch("https://api.provider.example/v1/chat", {
  headers: { Authorization: "Bearer " + API_KEY }
});

SiteTrellis encrypts keys at rest, shows them masked, never returns them to the browser and never writes them to logs. Details are in Security and privacy.

An illustrative cost walk-through

The AI part of a BYOK bill is arithmetic you can do yourself. Every turn sends your prompt, your knowledge and the conversation so far, and receives a short reply, priced per million tokens. Under the default assumptions, 6 visitor messages per conversation, 1,500 tokens of prompt and knowledge sent every turn, and 180-token replies, our model catalog gives these estimates for 1,000 conversations:

To turn that into a monthly figure, add the platform plan to the AI estimate scaled to your volume:

monthly cost = platform plan + (AI estimate per 1,000 x conversations / 1,000)

example, 2,000 conversations a month on a low-cost model:
  platform plan + (per-1,000 estimate x 2)

On the platform side, Free includes 100 conversations a month at $0, and Starter is $19 a month for 1,000. These are the plans as listed today; the pricing page is authoritative. The estimates ignore prompt caching, tool calls and taxes, real conversations vary a lot in length, and your provider’s bill is the final word. For your own numbers use the AI chatbot cost calculator, or read how much an AI chatbot really costs.

Questions to ask any BYOK chatbot vendor

Use this list on us as well. A good answer is specific and checkable.

1. Is any markup added to AI usage? The provider’s invoice should match your usage, not a multiple of it.
2. Where is the key stored, and can it ever be read back? Look for encryption at rest and masked display.
3. Which providers and models can I use, and can I mix them? Ask whether you can set a fallback on a different provider.
4. What happens when my key fails? Dead chat, or a friendly message and a backup model?
5. What does the plan limit? Conversations, sites, agents, seats, history. Is the unit defined, and does the plan quietly count model usage too?
6. What protects my key from abuse? Per-visitor rate limits and message caps in front of it.
7. What leaves my account when I cancel? Whether you can export leads and revoke the key.
8. What is not included? Honest vendors list their gaps. Ours are on the BYOK page.

Where to go from here

If BYOK sounds right, pick a provider and create a dedicated key with a spend limit. Our guides cover Anthropic, OpenAI, Gemini, OpenRouter and DeepSeek. Not sure which model to run? Read how to choose an LLM for website chat. If you would rather compare vendors first, start at the alternatives hub.