Bring Your Own Key — connect your own AI provider credentials to use beyond the platform free quota. Keys are stored encrypted and never returned in any API response.
How BYOK works: When your plan quota is exhausted, Wendesk routes AI calls to your own provider key. Your key is encrypted with AES-256-GCM before storage — it is write-only and cannot be retrieved via the API.
Security: Keys are encrypted with AES-256-GCM envelope encryption (per-tenant key derivation) before being stored. The plaintext key is never persisted. Only the encrypted envelope is stored. Keys can be revoked at any time — revocation disables the key immediately without deletion.
