BYOK stands for "bring your own key." Instead of paying a software vendor a flat fee that bundles AI usage, you create your own API keys with model providers — Anthropic, OpenAI, DeepSeek, Alibaba Qwen, Xiaomi MiMo, OpenRouter — and plug them into your tools. Your requests go straight to the provider, and the provider bills you directly for exactly the tokens you use.
How BYOK differs from bundled AI subscriptions
With a bundled subscription, the vendor sits between you and the model: they hold the keys, mark up or cap your usage, and route your prompts through their servers. That's convenient, but it means three things you can't see — the real cost of your usage, what happens to your prompts in transit, and which model you're actually being served when capacity is tight.
With BYOK, the economics and the data path are both transparent:
- No markup. You pay the provider's list price per token. The tool doesn't resell inference.
- No middleman on the wire. Requests go from your machine to the provider over TLS. In Cortex's case there is no proxy at all — the vendor never sees your code or prompts.
- Your choice of model, always. New model ships? Add it. Provider drops prices? You benefit the same day.
Why BYOK is usually cheaper for agentic coding
Agentic workflows — where an AI plans, edits files, runs tests, and iterates — consume far more tokens than chat. A single autonomous task can involve dozens of model calls. Under a flat-fee plan, heavy agentic use hits rate limits, queues, or "fair use" throttling, because the vendor is absorbing your inference cost.
Under BYOK you can route work by difficulty instead. Bulk agentic iteration goes to inexpensive, capable models — DeepSeek, Qwen, and MiMo all price aggressively — while frontier models like Claude handle architecture decisions and hard debugging. Heavy users routinely find this an order of magnitude cheaper than paying a fixed AI-IDE fee and hitting its ceiling. Light users win too: a few dollars of API credit can outlast a month of subscription.
The security question: where does the key live?
A BYOK tool is only as trustworthy as its key storage. An API key in a plaintext config file is one malware scan away from being someone else's API key. Before entering a key anywhere, check:
- Encrypted at rest? Cortex stores keys in the Windows Credential Manager, encrypted by the OS with DPAPI and tied to your Windows account, with an AES-256-GCM encrypted backup — never a plaintext file, never logged.
- Ever transmitted? Keys should be used locally to sign requests, not synced to the vendor's cloud.
- Auditable? Public code lets you verify claims instead of trusting them — Cortex publishes core components on GitHub, with full open-sourcing planned after security review.
What BYOK doesn't cover
Some features genuinely need server-side infrastructure regardless of whose model keys you hold — hosted web search, embedding generation for semantic code search, OCR. That's why BYOK tools often pair free BYOK usage with an optional subscription for hosted services. In Cortex, the IDE and BYOK chat are open source and free forever; the $10/month Pro plan adds web search, embeddings, OCR, and MCP server connections — and the IDE keeps working if you cancel.
Getting started with BYOK in five minutes
- Create an API key with one provider. DeepSeek or Qwen are cheap first choices; Anthropic or OpenAI if you want frontier quality.
- Install Cortex, open Settings → Models & Providers, and paste the key.
- Set a small spend limit in the provider's dashboard — good hygiene with any tool.
- Start with chat, then hand the agent a real task and watch the loop work. The docs cover every provider setup step by step.
Choosing between BYOK tools and bundled ones? Our guide to choosing an AI IDE on Windows walks through the full decision.