BYOK vs. Managed AI Keys: Which Plan Model Fits Your Agency

AgentLane's credential system supports exactly two source modes — platform and byok — and only two providers are even eligible for platform: anthropic and openai. Every other credential the platform touches (Cal.com, Resend, Twilio, Postgres) has no managed option at all; it's bring-your-own-key or it's not configured. That's not a pricing tier decision dressed up as a technical one — it's a real constraint in the credential schema itself.

Agencies evaluating whether to go BYOK or Managed AI often frame it as a cost question. It's really a risk-allocation question, and the schema itself is the clearest way to see where that risk actually sits.

The two source modes, exactly as they're defined

AgentLane's credential schema defines sourceMode as an enum with two values: platform and byok. A platform-mode credential means AgentLane's own managed key is used on the agency's behalf — no key to type in, no account to maintain. A byok-mode credential means the agency (or an individual client) supplies their own API key, which AgentLane stores encrypted and uses only for that agency's or client's own workflow runs.

The constraint that actually shapes the decision: PLATFORM_ELIGIBLE_PROVIDERS in the schema is exactly ['anthropic', 'openai']. Nothing else is eligible. Cal.com, Resend, Twilio, and Postgres are byok-only, full stop — there is no code path where AgentLane's platform supplies a Cal.com or Twilio credential on a client's behalf. If neither the client nor the agency has configured one of those, that part of the agent's workflow simply doesn't run; see Connect your integrations for the full waterfall.

So the real question isn't "BYOK or managed" across the board — every agency is already BYOK for Cal.com, Resend, Twilio, and Postgres, no matter what plan they're on. The actual decision is narrower and specific: who supplies the Anthropic or OpenAI key that powers the AI itself.

What Managed AI removes from your plate

On a Managed AI plan, the Anthropic and OpenAI credential cards on Settings → Integrations don't appear at all — not greyed out, not optional, absent. AgentLane's own platform key is used automatically for every client on that plan, with no account to create, no key to rotate, and no separate line item to track for AI token usage outside your plan's bundled allowance.

That removes a real category of operational overhead: you're not the one watching an Anthropic dashboard for rate limits, not the one whose card gets charged if a client's usage spikes unexpectedly, and not the one who has to explain a service interruption caused by your own API key hitting a quota mid-month.

What BYOK gives you back

Going BYOK on anthropic/openai means setting your own key — agency-wide as a default, or per client if a client wants to run on their own account and their own usage terms. The billing page's own token breakdown reflects this directly: /dashboard/billing shows AI tokens split by platform-billed vs. BYOK-tracked-only, which is the plain acknowledgment that these are two genuinely different accounting paths, not two labels for the same thing.

The upside of BYOK is control: your own rate limits, your own model version choices where the provider allows it, and no dependency on AgentLane's platform key ever being a bottleneck for you specifically. The tradeoff is that you now own that account's reliability — if your Anthropic key hits a rate limit or a billing hold, that's your agency's incident to resolve, not a platform-level one shared across every AgentLane partner.

If your plan doesn't bundle AI tokens, /dashboard/billing also surfaces AI credit packs — a way to pre-purchase platform-hosted AI usage that never expires, which sits in between the two extremes: you're still using AgentLane's platform key, but paying for usage in advance rather than it being bundled unmetered into your plan tier. See Billing & credits for the full mechanics of that page.

The decision, as a straight comparison

	Managed AI (platform)	BYOK (byok)
Who supplies the Anthropic/OpenAI key	AgentLane	Your agency, or the client
What you configure	Nothing — cards don't appear	An API key, at agency or client level
Who absorbs a rate-limit or quota event	AgentLane's platform account	Your own (or the client's) account
Where usage shows on billing	Bundled into your plan allowance	Tracked separately as BYOK usage on /dashboard/billing
Eligible providers	anthropic, openai only	Every provider, including the four that have no platform option at all

Every provider outside anthropic/openai is already in the right-hand column for everyone, regardless of plan — that's the constraint worth internalizing before comparing quotes or plan tiers.

Which one fits your agency

Managed AI fits an agency that wants AI usage to be one predictable line inside a plan they already understand, and doesn't want to own a third-party API relationship on top of everything else they're running. It's the lower-overhead default, and it's why the credential cards vanish entirely on that plan tier — there's genuinely nothing to configure.

BYOK fits an agency (or a specific client within one) that wants direct control over its own AI usage and cost — larger agencies running high volume who want their own negotiated provider terms, or a client who insists on their own account for their own compliance or budget reasons. It also fits an agency mixing a few high-usage clients with BYOK overrides on top of a Managed AI default for everyone else, since sourceMode resolves per client through the same waterfall as every other credential.

Current plan tiers, and which ones bundle Managed AI versus expect BYOK, are on the pricing page — check that against your own usage pattern before deciding, since tier availability is the part of this that changes independently of the underlying schema described above.

---

If you're setting AI credentials for the first time, Connect your integrations is the full walkthrough of the Settings → Integrations page this post assumes. For the exact request/response shape behind the credential API — including what sourceMode and data look like on the wire — see API Access → BYOK Credentials Vault.

---

The provider list and eligibility rules above are pulled directly from AgentLane's own credential schema, not summarized from a plan comparison chart — if it changes, this post will need updating before the pricing page does.