Scenario Users Bring Their Own Keys

Goal: You prepare the providers: server, model, and name. Each colleague adds only their personal API key, for example, the key of their account on your AI portal or at an AI service of their research institution. Costs and usage stay with each person.

You need: a service that issues personal API keys, and a short guide on how users get theirs.

Building blocks

What	How
A fixed provider whose key users add	AllowUserProvidedAPIKey = true on the provider
AI Studio asks for the key itself	PromptForUserAPIKey = true and the text in CONFIG["USER_API_KEY_PROMPT"]
One key for several models of the same service	All providers of one configuration with PromptForUserAPIKey share one key

The configuration

CONFIG = {}

CONFIG["LLM_PROVIDERS"] = {}

-- Two models behind the same AI portal, which share one personal key:
CONFIG["LLM_PROVIDERS"][#CONFIG["LLM_PROVIDERS"]+1] = {
    ["Id"] = "0f2b9a4e-8d0c-4b7a-9e1f-3a4b5c6d7e8f",
    ["InstanceName"] = "AI portal: large model",
    ["UsedLLMProvider"] = "SELF_HOSTED",
    ["Host"] = "VLLM",
    ["Hostname"] = "https://ai-portal.intra.example.org/api",
    ["PromptForUserAPIKey"] = true,
    ["AdditionalJsonApiParameters"] = "",
    ["Model"] = {
        ["Id"] = "openai/gpt-oss-120b",
        ["DisplayName"] = "GPT OSS 120B",
    },
}

CONFIG["LLM_PROVIDERS"][#CONFIG["LLM_PROVIDERS"]+1] = {
    ["Id"] = "1a3c0b5f-9e1d-4c8b-8f2a-4b5c6d7e8f9a",
    ["InstanceName"] = "AI portal: fast model",
    ["UsedLLMProvider"] = "SELF_HOSTED",
    ["Host"] = "VLLM",
    ["Hostname"] = "https://ai-portal.intra.example.org/api",
    ["PromptForUserAPIKey"] = true,
    ["AdditionalJsonApiParameters"] = "",
    ["Model"] = {
        ["Id"] = "openai/gpt-oss-20b",
        ["DisplayName"] = "GPT OSS 20B",
    },
}

CONFIG["USER_API_KEY_PROMPT"] = {
    ["Title"] = "Please add your personal API key",
    ["Markdown"] = [===[
        To use the AI models of Example Organization, you need a personal API key:

        1. Open the [AI portal](https://ai-portal.intra.example.org) and sign in.
        2. Open "Settings" and then "API keys".
        3. Create a key, copy it, and paste it below.
    ]===]
}

Without the prompt on the start page, use ["AllowUserProvidedAPIKey"] = true instead of PromptForUserAPIKey. Users then enter their key in the settings of the provider.

What users see

• After the start, the start page shows your text and an input field, first and open. AI Studio stays on the start page until the key is there.
• AI Studio checks the key with the first provider that can list its models. A key the service rejects isn't stored, and the user is told so. When the service can't be reached, AI Studio stores the key with a warning.
• In the settings, the providers show a key icon instead of a lock. Users can change their key, but nothing else.

Good to know

• Mark only providers that accept the same key with PromptForUserAPIKey. A service with another key belongs in a configuration of its own.
• When you withdraw the providers, AI Studio keeps the users' keys in the credential store, in case the providers come back.
• An APIKey on such a provider is ignored, with a warning in the log.
• For keys of tools, such as web search, see Tools and Web Access.

Check it

1. Stage the configuration on a test device, see Testing and Exporting Configurations.
2. The start page asks for the key. Enter a wrong key: AI Studio refuses it. Enter a valid one: both providers work.

Where to go next

• Configuration Scenarios
• Providers and API Keys