Bring your own key (BYOK) lets your organization use its own AI provider account for Para’s model requests. You keep talking to the same Para through email, chat, or the Work page. Your projects, files, and access groups stay in Para; your chosen provider supplies the model that does the reasoning.
Before you start
- An Enterprise agreement with BYOK enabled for your organization.
- A Para owner or administrator with a passkey to save credentials and change the selected provider.
- A provider account with API access, available funding or quota, and access to your chosen model. A chat subscription alone does not supply an API key.
- Your organization’s approval to send assignment content to that provider. Confirm the provider account’s data-handling terms with your IT team.
Connect and select your provider
Open Models
Go to Models in Settings and choose your provider. If Enterprise access is not enabled, contact sales@casemark.com.
Enter the connection details
Paste your API key and select Check & load models. Search the list and choose a model. When editing a saved provider, leave the key blank to reuse it. Azure and Bedrock use deployment or inference profile IDs from their consoles; custom endpoints also need an API base URL.
Save, then choose Use
Select Save and complete passkey confirmation when prompted. Saving a key does not test or activate it. Select Use followed by the provider’s name to choose it for new requests across your organization.
Try a small assignment
Send Para a short request using non-sensitive sample material. Confirm that you receive a result and that the request appears in your provider account before rolling it out to colleagues.
What each provider needs
| Provider | Details to enter |
|---|---|
| Anthropic, OpenAI, Google Gemini, xAI, OpenRouter, Baseten, Nebius, or Fireworks AI | API key, then choose a model from the discovered list or enter its ID. |
| Azure OpenAI | API key, model or deployment ID, and your Azure resource endpoint or resource name. API version and deployment map are optional. |
| Amazon Bedrock | Access key ID, secret access key, AWS region, and model or inference profile ID. |
| Custom endpoint | API key, model ID, public HTTPS API base URL, and either Chat Completions or Responses format. |
Custom endpoints must support streaming responses and tool calls. Enter the base URL, usually ending in /v1, without /chat/completions or /responses. Private-network endpoints and custom authentication headers are not supported. Your IT administrator can confirm compatibility.
Check & load models reads your provider’s catalog without generating billable model output. It confirms that Para can read that catalog, not that every listed model can complete an assignment. Choose a model with streaming and tool support, then try a small assignment. Fireworks discovery shows its serverless models with tool support; enter dedicated deployment IDs manually. Baseten lists its Model APIs catalog, which may include models you still need to enable in your Baseten account.
For each request, Para reads the model’s context window and output limit from Anthropic, Google Gemini, Fireworks AI, OpenRouter, Baseten, Nebius, and custom endpoints that report them. For OpenAI, xAI, Azure OpenAI, and Amazon Bedrock, or when a provider does not report limits, Para assumes a 128,000-token context window and a 16,000-token output limit, so very long assignments on larger models may stop early. Para does not send images to BYOK models.
For custom providers, Para checks /models under your API base URL. If the endpoint does not support model listing, you can still enter the exact ID manually. A denied check usually means the key lacks model-list permission or needs replacing. Changing a custom or Azure endpoint requires a new key; Para never sends the saved key to a different address.
Who pays for what
| Charge | Where to review it |
|---|---|
| Model usage through your selected provider | Your provider bills your organization under that account’s terms. Review usage and limits with that provider. |
| Para seats and services such as document processing and search | Your Para agreement still applies. Review your plan and Para usage separately. |
BYOK does not make Para usage free or remove Para’s funding requirements. The Usage page shows Para usage; it does not import your provider invoice or show your total BYOK model cost. Confirm seats, service charges, and any committed usage in your Enterprise agreement.
Changing providers or replacing keys
One provider and model are selected for the organization. The selection applies to new requests across Para’s channels, including new messages in existing conversations. Work already queued keeps its original provider and model. Individual members’ Para-managed model preferences do not override the organization’s BYOK selection.
- To replace a key, open the provider on Models, select Edit, re-enter its credentials, and save. Saved keys are encrypted and are not displayed again.
- Queued work uses the current key when it starts. Removing a key can stop queued work that needs it; removing it does not cancel a provider request already running.
- Changing an Azure or custom endpoint can stop work queued for the old endpoint. Submit a new request after confirming the replacement connection.
- To return to Para-managed models, choose Para and select Use Para. This is an explicit administrator choice and applies to new requests.
If a request cannot start or fails
Para does not silently switch to Para-managed models when your chosen provider fails. Ask an administrator to check that Enterprise access is active, the key is current, the model is available to your account, and the provider has sufficient quota. For Azure, Bedrock, or a custom endpoint, also check the deployment, region, and endpoint details. Once corrected, send the request again.