# BYOK — bring your own provider keys

Automaintainer is **BYOK**: agents run on **your** AI provider keys, configured
on the [worker](/docs/add-worker) host. AM never stores or transmits these keys —
they live only on your machine and are used by the local harness.

## Why BYOK

- **No lock‑in** — use any supported harness/model and switch freely.
- **Cost transparency** — you pay your provider directly for tokens; AM charges a
  platform fee, not a token markup. See [Billing](/docs/billing).
- **Privacy** — your code and your keys stay on infrastructure you control.

## Configure a key

Set the key the harness expects, on the worker host. Examples:

```bash
# claude (Anthropic) — or a Claude subscription login
export ANTHROPIC_API_KEY=sk-ant-...

# opencode / pi via an OpenCode‑compatible gateway
#   configure the provider per that tool's docs
```

Set it where the worker service can see it (e.g. the service environment file),
then restart the worker so it picks up the key.

## Which harness/model?

AM is harness‑agnostic: `claude`, `opencode`, `pi`, `tau`. Pick per repo in the
[team builder](/docs/teams-and-models). A few field notes:

- A **liveness probe** ("Say HI") only proves the *default* provider answers. The
  model your team actually uses can still fail (e.g. empty balance). Use the
  **Test** button to probe the **exact** cli/model — see
  [Verify readiness](/docs/verify-readiness).
- `claude` can use either an API key or a Claude subscription login.

## Gotchas

- **Out of balance** is the #1 cause of silent no‑op runs. The Test button
  reports it explicitly.
- After setting/rotating a key, **restart the worker** so probes refresh.

## Related

- [Verify readiness](/docs/verify-readiness)
- [Teams & models](/docs/teams-and-models)
- [Security & data](/docs/security)