Bring Your Own API Key (BYOK)

Bring Your Own Key (BYOK) lets you use your own Anthropic or OpenAI API keys for AI-powered features in SitePulse. This is useful for organizations with existing API contracts, cost control requirements, or who want to use their own usage dashboards.

Supported AI operations

GitHub audits require Anthropic (Claude Agent SDK). If you provide only an OpenAI key, GitHub audits use SitePulse's system Anthropic key.

Key resolution order

For each audit, SitePulse resolves which API key to use in this order:

1. Project-level key — set in Project Settings → Integrations → API Keys (project-specific override)
2. User-level key — set in Account Settings → API Keys (applies to all your projects across all orgs)
3. System key — SitePulse's own API key (used when no BYOK is configured)

If you provide an OpenAI key and an Anthropic key, SitePulse uses OpenAI for non-GitHub operations (it checks OpenAI first for cost efficiency).

Setting your API keys

Go to Settings → API Keys.

Anthropic key

1. Obtain an API key from console.anthropic.com
2. Enter it in the Anthropic API Key field
3. Click Save & Validate — SitePulse calls the Anthropic API to verify the key is valid and has credits

OpenAI key

1. Obtain an API key from your OpenAI account
2. Enter it in the OpenAI API Key field
3. Click Save & Validate — SitePulse validates with a minimal API call

Both keys are encrypted at rest using AES-256-GCM before storage.

Security

• Keys are never returned in API responses after saving — the UI shows only a masked value (sk-ant-...****)
• Keys are transmitted over HTTPS only
• Keys are decrypted in memory only at audit execution time, never logged
• Revoking a key in SitePulse does not revoke it at Anthropic/OpenAI — do that separately if needed

Project-level key override

For agency use cases where each client has their own AI contract, set a project-level key in Project Settings → Integrations → API Keys. This overrides your user-level key for that project only.

Project-level keys are visible to all Admins and Owners of the organization (not to Members).

Removing keys

Click Remove next to a key to delete it from SitePulse. Future audits on your projects will fall back to the system key (or user-level key if a project-level key was removed).