Model keys (bring your own key)
With bring your own key, WeHarness calls a provider’s models with your own API key instead of its own. The provider bills your account for those calls. It comes with the Medium and Large packages (not with Starter). During the pilot WeHarness assigns a package to your workspace on request (info@weharness.io). See Credits and usage.
Only these providers are supported for now:
| Provider | Models it pays for |
|---|---|
| Gemini 3.8 Flash, Gemini 4 Argon | |
| OpenAI | The GPT-6 models WeHarness offers |
| Anthropic | Claude Opus, Sonnet and Haiku 5.5 |
Adding a key
Section titled “Adding a key”Owners and admins open Settings → Model keys, paste the key and save it. Adding or replacing a key needs a sign-in from the last few minutes; WeHarness asks you to sign in again if yours is older. There is one key per provider.
WeHarness then checks the key with one read-only request to the provider that lists the models the key can reach; it never generates text to check a key. Until the key is verified, that provider’s models run on WeHarness’s key. A key that lists a model reaches it; whether WeHarness offers that model is shown apart, beside it. A result is reused for 10 minutes, and when the provider cannot be reached the check is tried again after 30 seconds, 2 minutes and 10 minutes, then left for you to ask again (Verify again).
After saving, the key is never shown again. You see its provider, its last four characters, who added it and when, and its last check.
When your key is used
Section titled “When your key is used”Once verified and turned on, your key pays for that provider’s models in:
- your session’s replies, when the session uses one of its models;
- plans, when the planner runs on one of its models;
- the models the code WeHarness runs for you calls in its sandbox. The sandbox never receives your key: it gets a token that works only for that sandbox, and WeHarness adds your key on the way to the provider.
WeHarness’s own work, such as session titles, reading attached images and search embeddings, stays on WeHarness’s key.
Members’ sessions use the workspace’s keys, so the workspace’s owner pays the provider for their work. Members never see the key; only owners and admins add, change or remove it. Owners and admins can give members a monthly and a per-run budget in Usage & billing: work on the workspace’s keys counts toward it at the same rate as credits. Viewers never start work that uses credits or a key. Viewers, API and MCP tokens, and WeHarness staff can never read or set a key.
Your key or WeHarness credits, per session
Section titled “Your key or WeHarness credits, per session”When the workspace has a verified key for the session’s model, a choice appears beside the model picker under the message box: Your key (the default) or WeHarness credits. Anyone who can send messages in the workspace chooses, for that session. On WeHarness credits, the session’s models run on WeHarness’s key and use credits as usual.
When the provider refuses your key
Section titled “When the provider refuses your key”The call stops and the session says why, for example: “Your OpenAI key was refused: the provider did not accept the key (HTTP 401)”. WeHarness never retries with its own key by itself. To go on, switch the session to WeHarness credits and send your message again; an owner or admin can also replace the key or turn it off in Settings → Model keys.
Credits
Section titled “Credits”A model call paid by your key uses no credits, and a message whose model calls were all paid by your key uses none at all. Sandbox time, decisions and a plan version’s planning fee (5 credits; a plan on your key uses only that) still count; you are never charged again for inference your key paid. See Credits and usage.
How the key is protected
Section titled “How the key is protected”- It is encrypted (AES-256-GCM) as soon as it reaches WeHarness, bound to your workspace, the provider and the key’s own record. The web service can store it but cannot read it back; only the services that make the call open it, in memory, for that call.
- It is sent only to the provider’s official API address. There is no setting for another address, so it cannot be sent anywhere else.
- It never appears in logs, traces, error messages, receipts, exports, prompts, the sandbox or your browser. A provider’s own error text is never shown or kept, because some providers repeat part of the key in it.
- Removing it deletes it. Deleting the workspace deletes its keys; an export never contains them.
- WeHarness staff see only the metadata above.
Your provider’s own terms and data locations apply to calls made with your key.