Whose key is it? When the AI in your tools runs on the vendor's account
On a hosted tool, the AI often runs on the vendor's key: its quota, its gateway, its model, its bill. What to check before you depend on it.
A user of a hosted automation tool reported in the tool's community forum that their AI video workflow failed after one upload. The workflow made short videos with AI and posted them to the user's own channel. Its upload step used the ready-made connection that the tool marked as recommended, and the account showed as connected. The first video went up. The next upload failed with a quota error. The error named a cloud project that the user could not find in their own account.
A forum helper, not a member of staff, replied that the project belongs to the app behind the tool's ready-made connection, and that every customer of the hosted service who uploads that way shares its daily quota. When we read the thread, the vendor's staff had not confirmed or denied this. The helper suggested a second connection through the user's own cloud project, for the upload step only, so the channel gets its own quota.
The connection was working. It was just not the user's.
Every ready-made path runs on someone's key
Hosted tools make the first day easy. You connect a service with one click, pay for model calls with the tool's credits, and let the built-in assistant build the workflow. Behind each of these sits a key: an app registration, an API key, an account with a provider. On a hosted tool, that key is often the vendor's.
That is a fair trade on the first day. It changes once a workflow does real work. The vendor's key brings the vendor's quota, route to the model, choice of model and way of counting cost. When something on that path goes wrong, you see the error, but you cannot reach the cause.
The same question applies to every connection an agent makes; see connecting an AI agent to your systems.
The same shape, three more times
A user of the same hosted service reported that an agent which had worked before now failed at its model step. A web security service denied access, and the block named the vendor's own domain. The agent reached its model through the vendor's gateway, paid for with the vendor's credits. A forum helper advised writing to the vendor's support. To keep working meanwhile, the helper suggested switching the model step to the user's own key from the model provider.
Another user reported high daily costs on a personal project. They explained that the model calls inside their workflows cost little. The cost came from the tool's built-in assistant, which they used for hours each day to build and fix workflows. It ran on a model they could not change. They could not see its token use, and they topped up its credit almost every day. A second user in the thread wrote that their own credit use for building had jumped too.
In a separate thread, a user reported that the same assistant was slow and asked for another model. A forum helper replied that on the hosted service the vendor manages that model and does not accept a change, and that in a self-hosted install an administrator can choose it with their own key.
A third user was choosing between the vendor's credits and their own key, for workflows that repeat the same long instructions. They asked in the forum how the vendor's gateway bills input that the model provider has cached, and whether that caching works through the gateway at all. A moderator from the vendor replied that they could not confirm those charges, and sent the user to support.
In each case the user saw the effect: an error, a bill, a slow assistant. The cause sat on a path that the user did not own.
What your own key changes, and what it does not
Three of these threads carry the same suggestion: use a key or an app of your own. Then the provider's limits are the limits of your account, not a pool you share with other customers of a tool. The bill comes from your provider, so you can check the charges at the source. When something breaks, you deal with the provider directly.
In EpicStaff, the model is chosen per agent, from your organisation's model settings, and you add the provider key yourself. EpicStaff runs on your own infrastructure; model calls go to the providers you configure. For what it takes to own the rest of the stack, see self-hosted AI: how to own your AI stack.
Your own key does not make AI free or failure-proof. You still pay for every token, and your provider can still have an outage or limit your calls. You also now hold a secret. Decide where it is stored, who can see and change it, and how you replace it if it leaks.
A key shows you the bill, not the step
The provider's bill shows what your account used. It does not know your workflows, agents or steps. For that, the tool itself has to record use, close to the work.
EpicStaff records the tokens each run used, and the session export (JSON) includes them. On screen, the running-flow view shows the total tokens and the prompt tokens for each node message. EpicStaff also estimates a cost in US dollars, from the price set on the model setting or, if none is set, from the public price list. The session record holds the total, and decision-table steps show it on screen.
For more on keeping agent spend in view, see AI agent cost control.
Before you depend on it, map it
Take the workflow you would miss most if it stopped tomorrow. Follow it from start to finish. Stop at every step that calls a model or an outside service, and write down four answers.
- Whose key is it? Yours or the vendor's. If the vendor's, can you switch to your own, and what would you give up?
- Whose quota is it? If a limit is shared with other customers, a busy day somewhere else can stop your work. How would you find out?
- Which model runs, and who can change it? Include the built-in assistant if you build with it. A model you cannot choose is a cost you cannot steer. For who decides when the model itself changes, see Who decides when the model behind your agent changes?
- Where do you see tokens and cost? At each step, for each run, or only on the monthly bill?
An answer that says "the vendor's" is not a mistake. It can be the right choice for a trial, or for work that can wait a day. It is a dependency. Once it is written down, it has a name, and someone can own it.
The user in the first report chose the connection that the tool marked as recommended. It worked until it hit a limit on a project that was not in the user's account. The question to ask on the first day is a short one: whose key is it?
Questions & Answers
What does bring your own LLM key mean?
It means a tool calls the language model (LLM) with an API key from your own account at the model provider, not with the tool vendor's key. The provider bills you directly and applies your account's limits. The tool still runs the workflow; the model account, its usage records and its bill are yours.
Should I use the platform's AI credits or my own API key?
Credits are quick to start: one bill, nothing to set up. Your own key takes a little set-up, and gives you the provider's own records and limits that belong to your account. To compare cost, run the same workflow both ways for a week and compare what you actually paid. For a workflow the business depends on, control usually matters more than the set-up time.
Why does my workflow hit a quota limit when I have barely used it?
The quota may not be yours. Some ready-made connections in hosted tools use the vendor's own app or account, and its limit can be shared by many customers. If the error names a project or account that you cannot find in your own settings, ask the vendor whose it is. A connection through your own app or key gives your work its own quota.
In EpicStaff, whose key does an agent use, and where do I see its tokens and cost?
The provider key you add yourself: the model is chosen per agent, from your organisation's model settings. EpicStaff runs on your own infrastructure; model calls go to the providers you configure. It records the tokens each run used, and the session export (JSON) includes them. The running-flow view shows the total tokens and the prompt tokens for each node message. EpicStaff also estimates a cost in US dollars, from the price set on the model setting or, if none is set, from the public price list. The session record holds the total, and decision-table steps show it on screen.
