Add your LLM key (bring your own key)

SentientOne doesn't sell model access, and there's no shared or default model key: an agent can't reply until it has a key from your own provider account. You pay the provider directly for tokens, at their prices, with no markup. SentientOne credits pay for the platform itself.

Before you start

• An account with one of the four providers agents can use, with billing set up on their side.
• A new API key from the provider's console. Most providers show a key only once, so copy it straight away.

Steps

1. 1

   Open LLM keys

   In the app's sidebar, under Configure, open LLM keys and choose Add key.

2. 2

   Save the key

   Pick the provider and paste the key. It's encrypted before it's stored, and from then on it's only ever shown masked (the last four characters).

3. 3

   Use it on an agent

   When you create an agent (Agents → New agent, under Model) or on an agent's Settings tab, choose the saved key, or paste a key there directly. Save the agent.

How your key is protected

• Encrypted at rest with AES-256-GCM: 256-bit AES, the strongest AES key size, in an authenticated mode, so a stored key can't be read or quietly altered. Every value gets its own random 12-byte IV.
• The encryption key is held only in the server environment of the app and the API, never in the database, so the database alone can't reveal your key. Caches only ever hold the encrypted value.
• Your key is decrypted in memory only at the moment a request calls your provider, and it's used for nothing else.
• After you save it, it's never shown again in full, in the app or through any endpoint: you see •••• and the last four characters.
• The same encryption protects MCP server tokens and passwords, workflow signing secrets and Slack webhook URLs.

How saved keys reach agents

• A saved key is copied (encrypted) into the agent when you save the agent. At answer time, the agent uses its own copy. If you replace a saved key, open each agent that uses it and save it again.
• Deleting a saved key doesn't remove the copy already on an agent.
• Workflow Classify, Extract and AI Guardrail blocks run on the key of the agent you pick in the block.
• Each request sends the prompt, the retrieved passages, the conversation history and tool results to the provider, on your key.

A key for one request

Send a provider key in the X-Llm-Key header and the API uses it for that request instead of the agent's key. It's not stored. Requests with X-Llm-Key skip the answer cache. The widget can't send it.

curl -N https://api.sentientone.ai/v1/chat/stream \  -H "Content-Type: application/json" \  -H "X-Api-Key: $SENTIENTONE_API_KEY" \  -H "X-Agent-Id: $AGENT_ID" \  -H "X-Llm-Key: $CUSTOMER_OPENAI_KEY" \  -d '{"message": "Hello"}'

If something goes wrong