Bring your own LLM (BYOK)

Appilot can run the assistant in three operational modes. The first two are managed (Appilot pays the LLM bill and charges your credit balance); the third is BYOK (you pay your LLM provider directly and Appilot does not consume credits for LLM tokens).

Mode	Who picks the model	Who pays the LLM	Credits consumed	Available on
Appilot default	Appilot, globally	Appilot	Yes	Every plan
Managed override	Appilot, per-organization	Appilot	Yes	Every plan
BYOK	You, per-organization	You (your provider account)	No	Enterprise plans

This page explains when each mode applies, how BYOK is configured, and what it changes about billing, support, and operations.

The first two modes (default and managed override) differ only in which model runs for your organization. Both are managed by Appilot: we hold the provider account, we pay the LLM bill, and we charge you in credits at your plan's markup. The override exists so that Appilot can put your organization on a premium model (for example, Claude Sonnet 4.6 for a regulated workflow) without you having to handle a provider relationship.

The third mode, BYOK, is the topic of the rest of this page.

When to choose BYOK

BYOK exists for organizations with specific reasons to keep the LLM call inside their own contract. The most common ones:

• Data residency / sovereignty. You operate in a regulated jurisdiction and the model invocation must stay inside an approved provider, region, or on-prem instance (for example: an EU-only Anthropic deployment, an on-prem Gemma server, an air-gapped Mistral cluster).
• Existing enterprise contract. Your company already pays for OpenAI, Anthropic, Azure OpenAI, or Bedrock at volume rates that beat Appilot's per-credit price.
• Model lock. Your security or compliance team has approved one specific model and version; you do not want Appilot to upgrade models on your behalf.
• Cost transparency. You want the LLM invoice line on your existing provider statement, not on the Appilot invoice.

If none of the above applies, managed mode is almost always the better choice: simpler billing, no provider account to maintain, automatic model updates, and Appilot absorbs provider outages.

What changes with BYOK

Concern	Managed mode	BYOK mode
LLM provider account	Appilot's	Yours
Who pays the LLM bill	Appilot (you reimburse via credits)	You, directly to your provider
Appilot credits consumed by LLM tokens	Yes	No
Appilot subscription required	Yes	Yes (covers platform, storage, KB, tools, support)
Model version	Appilot picks and may upgrade	You pick and pin
Provider outage	Appilot can route around it	You handle it
Support scope for LLM issues	Appilot owns the ticket	You own the ticket with your provider; Appilot owns the integration

The Appilot subscription is still required. BYOK shifts only the LLM token cost. Everything else (the Backoffice, the Editor in-context, the knowledge base storage, the widget delivery, the tools runtime, the conversation observability, the support engagement) is the same managed service.

Eligibility

BYOK is available on Enterprise plans. Trial, starter, and B2C plans are managed-only. If your current plan does not allow BYOK, the Platform Admin save will be rejected with a clear error. Contact Appilot sales to upgrade.

Configuration

Configuration lives in Platform Admin → Organizations → [your org] → v3 LLM Provider.

The section shows three things at a glance:

1. The current billing mode: a badge reads either "BYOK · no metered billing" or "Managed · Appilot bills credits". There is no ambiguity about which mode your organization is in at any moment.
2. What the agent is using right now: either the saved BYOK configuration (with provider, model, base URL, key status, and last-verified timestamp), or the Appilot-managed default the agent falls back to.
3. An editor to add or update the configuration.

Add a configuration

1. Pick a provider from the dropdown. The model and base URL pre-fill with sensible defaults for that provider.
2. Optionally pick a different model from the curated list, or choose Custom… to type any model id the provider accepts.
3. For on-prem Gemma, fill in the Base URL (the OpenAI-compatible endpoint, e.g. https://llm.internal.acme.com/v1). The API key is optional and only used if the endpoint sits behind a bearer-auth proxy.
4. For Anthropic and OpenAI, paste an API key. The key is encrypted at rest with AES-256-GCM and is never returned by the API after save. Reads only expose a has_api_key boolean.
5. Click Test connection. Appilot makes a non-billing probe (a GET /models call for OpenAI and Gemma, or a 1-token completion for Anthropic) and reports latency or the specific error. On success, the configuration's last verified timestamp updates.
6. Click Save configuration. The org is now in BYOK mode.

Disable a configuration without losing the API key

The Disable button on a saved row marks the configuration inactive. The encrypted API key is preserved; the agent falls back to the Appilot-managed default until you re-enable it. Use this for short-term tests ("does the managed model handle this case better?") without re-pasting credentials.

Delete a configuration

The Delete button removes the row entirely. The encrypted API key cannot be recovered afterwards. Use this when rotating keys is no longer enough (provider migration, account closure, key compromise).

Billing details

When the organization is in BYOK mode:

• LLM tokens: invoiced directly by your provider on your existing account. Appilot does not see the cost or the token count.
• Appilot subscription: charged as usual. This pays for the platform: Backoffice, Editor, KB, tools runtime, widget delivery, observability, support.
• Appilot credits: not consumed by LLM usage. They remain available for non-LLM features that may be metered in the future (currently none).
• Per-user credit caps and coverage policies: still respected for non-LLM operations. If your policy restricts the assistant to a domain allowlist, that gate continues to apply.

Switching modes is reversible. Disabling the BYOK configuration returns the org to managed mode on the next conversation; re-enabling switches back to BYOK on the next conversation. No data migration is needed.

Privacy and security

• API keys are encrypted at rest with AES-256-GCM and never logged, returned by the API, or transmitted in plaintext outside the per-request memory of the agent process.
• Test connection probes never invoke a billable completion (except for Anthropic, where the minimum 1-token probe costs less than $0.00001).
• Provider-side data handling (logging, retention, training opt-outs) is governed by your contract with the provider, not Appilot's. Configure your provider account accordingly.

FAQ

Can different organizations use different providers? Yes. Each organization has its own configuration row. You can have one org on managed Anthropic, another on BYOK OpenAI, and a third on an on-prem Gemma in the same Appilot tenant.

Can one organization mix BYOK and managed within a single conversation? No. The provider is resolved per-organization, not per-conversation or per-message. The entire conversation runs against one provider.

What happens when my key expires or is revoked? The agent will fail at the next conversation turn with a provider error. The Backoffice surfaces the failure on the AI Reports page. Disable the BYOK configuration to fall back to managed mode while you rotate the key, or paste a new key into the same configuration.

Do you support Azure OpenAI / Bedrock / Mistral? The current providers are Gemma (on-prem), Anthropic, and OpenAI. Azure OpenAI works today through the OpenAI provider entry by pointing the Base URL at your Azure endpoint. Bedrock and Mistral are on the roadmap. Talk to Appilot about your specific provider.