BYOK Agent Chat

Bring Your Own Key (BYOK) lets you use your own provider API key for agent chat, paying only for actual usage with a 10% platform markup.

How BYOK works

1. You store your provider API key in the Agent Gateway's encrypted vault
2. When you chat, the gateway unlocks your provider key for the active session
3. You pay the model provider directly for LLM usage
4. RickyData charges a 10% platform markup + $0.0005 per MCP tool call
5. Total cost is deducted from your wallet's USDC balance

New provider keys are encrypted with sign-to-derive: your wallet signs one deterministic provider-vault message, and that signature derives the encryption key. The gateway persists ciphertext only. After a restart or cache expiry, one provider-vault unlock signature unlocks all configured provider keys for the active session. Decrypted keys are cached only in gateway memory for a bounded session window inside the AMD SEV-SNP TEE.

Store your API key

CLI

rickydata apikey set
# Prompts for your sk-ant-... key

When the CLI profile was created with rickydata auth login --private-key, apikey set uses the unified provider-vault sign-to-derive flow. The chat CLI also unlocks the provider vault automatically from that local private key before starting a session.

SDK

import { A2AClient } from 'rickydata/a2a';

const client = new A2AClient({
  baseUrl: 'https://agents.rickydata.org',
  token: 'mcpwt_...',
});
await client.storeApiKey('sk-ant-...');

Check status

rickydata apikey status

The status endpoint never returns key material — only whether a key is configured.

Provider selection

Connect wallet to see your provider settings

Default free-tier model

Without a BYOK key, the free tier uses MiniMax-M2.7 as the default model. This gives you 100 requests per day at no cost.

BYOK models

With your Anthropic key stored, you can use any Claude model:

Model	CLI shortcut	Use case
Claude Haiku	haiku	Fast, low-cost responses
Claude Sonnet	sonnet	Balanced quality and speed
Claude Opus	opus	Highest quality reasoning

Switch models in the chat REPL:

/model sonnet

Other providers

BYOK supports additional providers beyond Anthropic:

• OpenRouter — OpenRouter-hosted models
• Z.ai — GLM models
• DeepSeek — DeepSeek models
• Gemini — Google Gemini models
• OpenAI — Codex/OpenAI execution

Configure providers in Wallet settings:

rickydata wallet settings

Cost breakdown

BYOK path

Platform cost = (10% × base LLM cost) + ($0.0005 × MCP tool calls)

Example: A chat turn that uses Claude Sonnet ($0.003 input + $0.015 output = $0.018 base) with 2 tool calls:

Platform cost = (10% × $0.018) + ($0.0005 × 2) = $0.0018 + $0.001 = $0.0028
Total cost = $0.018 (Anthropic) + $0.0028 (platform) = $0.0208

Free tier path

100 requests/day, MCP tool calls count as 0.25 each
Default model: MiniMax-M2.7

Start chatting

CLI

rickydata chat erc8004-expert

SDK (streaming)

const task = await client.sendStreamingMessage({
  message: {
    role: 'user',
    parts: [{ type: 'text', text: 'What is ERC-8004?' }],
  },
  metadata: { agentId: 'erc8004-expert' },
});

for await (const event of task) {
  if (event.type === 'text') process.stdout.write(event.text);
}

React

import { useAgentChat } from '@rickydata/react';

function Chat() {
  const { messages, sendMessage, isStreaming } = useAgentChat({
    agentId: 'erc8004-expert',
  });
  // ... render messages and input
}

Key management

Action	CLI	SDK
Store key	rickydata apikey set	client.storeApiKey(key)
Check status	rickydata apikey status	useApiKeyStatus()
Delete key	rickydata apikey delete	useDeleteApiKey()

Keys are stored in the Agent Gateway's encrypted vault with:

• AES-256-GCM encryption with per-user HKDF-derived keys
• HMAC-SHA256 vault keys (wallet addresses never stored in plaintext)
• Optional persistent encrypted storage across gateway restarts

Next steps

• Sessions — session management and persistence
• Voice Chat — LiveKit voice interactions
• Wallet & Billing — funding and spending controls