BYOK (bring your own key)

BYOK — bring your own key — is the option to point Marriska at your OpenAI / Anthropic / Groq / Gemini account instead of using the keys we’ve billed for. When you do, the provider bills you directly instead of us. It’s a paid feature — Starter and up, not part of Free.

This page is about why the option exists and what it actually changes. For the workflow, see How to use your own OpenAI key.

Why we built it

Three reasons, in order of importance:

1. Run AI on your own provider account

Test generation, parsing, translation, and visual regression all hit LLM providers. By default that inference runs on Marriska’s keys, bundled into your flat tier price. With BYOK it runs on your provider account instead — the calls land on your provider bill, at your provider’s rates, under your own agreement with them.

It doesn’t lift your plan’s monthly AI quota — that’s per tier regardless of BYOK. What changes is whose account and whose terms the inference runs under.

2. Faster latency on cold paths

When the platform key is shared across all users, request bursts queue. With your own key, you get your own rate-limit budget — no one else’s run hits your provider quota.

3. Trust and audit boundary

Some teams need to know which logical entity touched their pages and how the inference was billed. With BYOK, the provider’s logs are your provider’s logs. Marriska is no longer the financial intermediary, and there’s a paper trail you control.

How the routing works

Each AI task — translation, parsing, visual comparison — is dispatched through a ProviderRegistry that picks the right client based on configured provider/model. With per-user BYOK enabled:

1. Your key is stored Fernet-encrypted in the database, per user.
2. Each AI call checks “does this user have a BYOK key for this provider?” first.
3. If yes, the call goes through your key. If no, it falls back to the platform key.

Routing is per-task, so you can BYOK the expensive paths (parsing, visual regression) and let the cheap ones run on platform keys.

A Test connection button in Settings → AI Providers runs a liveness probe (POST /settings/byok/test) against the saved key, so you can confirm the credential works before relying on it.

Per-user BYOK is disabled by default

The per-user key store is built — routes, a Fernet-encrypted database store, the DB model + migration, and the full Settings → AI Providers UI all exist. It’s disabled by default: an operator turns it on by setting BYOK_ENCRYPTION_KEY. Until then the Settings → AI Providers page shows it disabled and the BYOK routes return 503. It’s not user-facing on the hosted plan yet. See How to use your own OpenAI key for what’s available today.

Supported providers

Marriska’s provider registry routes to five backends:

Provider	What it’s good for	Notes
OpenAI	All four tasks (translation, parsing, vision, generation)	The default for visual comparison
Anthropic	Translation, parsing, generation	Doesn’t currently work for visual regression — vision API differences
Google Gemini	All four tasks	Vision-capable models work
Groq	Translation, parsing	Fast and cheap for non-vision tasks
Ollama	Anything you have a local model for	Local-only — useful for self-hosters / privacy

The list a given install actually has depends on which API keys are configured. The Settings → LLM Models panel shows which are green (“ready”) versus grey (“not configured”).

When is BYOK worth it?

BYOK isn’t a way to save money or do more — you still pay your plan, your AI calls are still capped by the same per-tier quota, and now they also show up on your own provider invoice. So it’s not a cost lever. Reach for it when you need:

• Control and compliance. Inference must run on your provider account — your data agreement with the provider, your logs, your audit trail. This is the most common real reason.
• Your own rate-limit headroom. On the shared platform key, request bursts can queue behind other users; your own key gives you dedicated budget.
• A specific provider or model you’ve vetted and want to pin to.

If none of those apply, the platform key is simpler — stay on it.

What stays on platform keys

Even with BYOK on, a few things keep using platform infrastructure:

• Test execution itself (Playwright). BYOK is about the LLM calls, not the runner.
• Storage (Postgres, screenshot blobs).
• Scheduling and orchestration.
• Auth, billing, dashboards.

In other words: BYOK changes who pays for the AI inference, not who runs the test or stores the data.

Related

• How to use your own OpenAI key — the workflow (and what’s currently shipping vs. coming)
• Visual regression — the heaviest AI path, and a common one to pin to your own provider
• Plan tier limits — where BYOK sits in the tiers (Starter and up)