Running a website AI agent on your own API key

What does bringing your own key actually change?

Three things, and only the first one is about money.

The bill splits in two. Software from the chat vendor, model usage from the model provider at list price. Nobody is taking a margin on the second one, and you can read the line items.

The data path changes. Your conversations go to a provider you chose, under an agreement you signed, with that provider's retention and training terms. With a resold model you are trusting the chat vendor's arrangement with a provider you may not be told the name of.

The dependency changes. If the chat vendor repackages its AI add-on next year, your key and your provider are unaffected. The thing you would have to replace is the software around the agent, which is a smaller thing to replace.

What does a month of model usage cost?

It is a calculation rather than a number, and it is worth doing before assuming either arrangement is cheaper.

Take your monthly chat volume. Estimate tokens per conversation, which for a support or sales exchange with retrieved knowledge in the prompt is usually a few thousand in and a few hundred out, and is higher than people guess because the knowledge you retrieve counts as input on every turn. Multiply by your provider's published per token rates, which are on their pricing page and change often enough that quoting them here would be quoting a stale number.

Then compare that to what a bundled plan charges for the same volume. The pattern to look for is where the two curves cross: bundled plans are usually cheaper at low volume, because you are not paying for a minimum, and more expensive at high volume, because the margin scales with your success.

The other number worth having is what your worst month looks like. Per resolution and per message pricing is priced against the outcome you were trying to increase, so the month a campaign works is the month the bill moves.

Why can the key never sit in the browser?

Because a browser hands its source to anyone who asks. A key in client side JavaScript, in an environment variable that gets inlined at build time, or in a request the page makes directly to the provider, is a key that is published. Anyone who opens the network tab has it, and they can then spend your money against your account until you notice.

The correct arrangement is that the widget talks only to the chat vendor's server, the server holds the key, and the server calls the provider. The key is encrypted at rest rather than sitting in plain text in a database, and it is never sent to the page.

This is a worthwhile question to ask any vendor offering bring your own key, because the cheap implementation is the insecure one. Ask where the key is stored, whether it is encrypted at rest, and whether any request from the browser ever carries it.

When is a resold model the better deal?

Genuinely often, and it is worth saying so.

At low volume a bundled allowance is simpler and may be free at the margin. You do not have to open a provider account, mind a key, watch a spend limit or field an alert at midnight because a rate limit was hit.

If nobody on your team wants to own an API account, the operational cost of bringing your own key is real and it lands on a person rather than on a budget line. That is a reasonable thing to pay a vendor to take away.

Bringing your own key pays off when volume is high enough that the margin is visible, when the data path matters to you or to your customers, or when you already have a provider relationship and want the agent inside it.

How does IntellQ do it?

The workspace connects its own provider and its own key: OpenAI, Anthropic, Gemini, or anything that speaks the OpenAI chat completions shape, including something you host yourself. The key is encrypted at rest with a key held in the environment rather than in the database, it is decrypted server side at the moment of the call, and it is never sent to the browser.

IntellQ does not resell tokens and does not mark them up, which is the reason the USD 15 price does not move with how much the agent talks.

The agent answers only from knowledge the business added: website pages it fetched, PDFs, Word documents or pasted text. It can call your own systems through MCP tool servers the workspace connects, a booking calendar or an order lookup for example. It hands over to a person for orders, appointments, payments, refunds and complaints, it never asks for card numbers, passwords or one time codes, and asked outright whether it is a human it says it is an assistant and brings a colleague in.