What Bringing Your Own API Key Really Means

There are two ways a business gets AI inside its CRM. Either the vendor supplies it, meters it and bills you a bundled rate, or you create an account with a model provider and paste your own key in. The second sounds like extra work and mostly is not — and our guide to choosing an AI model for customer chat treats it as the default because of what it changes downstream.

You see the real numbers

With a bundled plan, AI appears as a line on an invoice with a credit balance attached. You cannot see how many tokens a conversation used, which conversations were expensive, or what the underlying rate was. With your own key, the provider's dashboard shows daily spend, request volume and which model was called.

That visibility is the precondition for controlling cost at all. Nearly every meaningful cost reduction — trimming retrieved context, shortening system prompts, routing simple questions to a cheaper model — depends on being able to see the effect, as set out in what an AI reply actually costs you.

You are the data controller's counterparty

This is the part that matters legally. When you hold the key, the relationship over your customers' messages is between your business and the model provider, governed by their terms and whatever data processing agreement you accept. Nobody sits in the middle re-selling access.

It also means you choose the commercial terms, including whether the provider may use your data to train models — most business tiers say no by default, but you should read it rather than assume. If your business is in the EU or handles regulated data, the questions to ask are the ones in data processing agreements and subprocessors.

“

If you cannot see how many tokens yesterday used, you are not managing an AI. You are subscribing to one.

— be digital ai team

You can leave

Model quality and pricing move quickly. A CRM that lets you change providers by pasting a different key means a provider getting worse, more expensive or unavailable is an afternoon's problem rather than a migration. That optionality is worth more than any single month's price difference, and it is what makes the exercise in comparing AI providers for customer chat worth repeating.

It cuts the other way too. If your CRM vendor raises prices, your AI setup is not hostage to that decision, because the expensive part of the stack is billed to you directly.

What you take on

The trade-offs are real and mostly administrative.

• You need an account with the provider, a payment method, and someone who notices when the card expires. An AI that silently stops answering at month end is a bad way to learn this.
• You set the spending limits. Most providers let you cap monthly usage — do it on day one, before you know your volumes rather than after a surprise.
• Rate limits are yours. New accounts start with modest quotas; if you plan a campaign that will triple traffic, raise the limit in advance.
• The key is a credential. It belongs in the CRM's settings and nowhere else — not in a shared document, not in a group chat.

Treat the key like a password

A leaked API key is someone else's bill on your card, and it will not look obviously wrong until the total does. Rotate it if it has ever been pasted somewhere it should not have been, keep it out of screenshots during onboarding calls, and use a separate key for testing so you can revoke it without breaking production. The same handling rules that apply to any credential in a shared inbox apply here, and they are worth reading in securing customer data in a shared inbox.

When bundled is the better answer

Owning the key is not always right. If you are a single-person business, running low volumes, and the idea of a provider account is what stops you switching on AI at all, take the bundled option and revisit it when volume justifies the attention. The point is that the decision should be yours and reversible — not something the software made for you and never mentioned. What you should insist on either way is knowing which model is answering your customers and being able to change it. A CRM that will not tell you what is running behind the chat is asking you to trust a black box with the single most visible part of your service, and that is a bad trade at any price.