API Key Management

Learn how to securely manage your AI provider API keys in GreenMonkey's BYOK (Bring Your Own Key) system.

Understanding BYOK Security

What is BYOK?

BYOK (Bring Your Own Key) means:

You provide your own API keys
Keys are encrypted with AES-256
You maintain full control
No vendor lock-in
Direct billing from providers

Security Features

Your keys are protected by:

Military-grade encryption - AES-256 encryption at rest
Secure transmission - HTTPS only, never logged
Access control - Only you can view/modify
Audit trail - Track all key usage
Auto-expiration - Optional time limits

Adding API Keys

Step 1: Get Provider Keys

First, obtain keys from AI providers:

OpenAI

Visit platform.openai.com
Go to API Keys section
Click "Create new secret key"
Copy immediately (shown once!)

Anthropic (Claude)

Visit console.anthropic.com
Navigate to API Keys
Generate new key
Save securely

Google AI (Gemini)

Visit makersuite.google.com
Get API key from settings
Enable necessary APIs
Note usage limits

Step 2: Add to GreenMonkey

Go to Dashboard → API Keys
Click "Add New Key"
Select provider type
Enter your key details:
- Name - Friendly identifier
- API Key - Your secret key
- Usage Limit - Optional monthly cap
- Expiration - Optional auto-expire

Step 3: Verify Key

After adding:

Click "Test Connection"
Verify successful response
Check remaining credits
Confirm model access

Managing Multiple Keys

Organization Strategies

By Purpose

OpenAI - Production
OpenAI - Development
OpenAI - Testing
Anthropic - Main
Google AI - Backup

By Project

Client A - GPT-4
Client B - Claude
Personal - All Models
Side Project - Gemini

By Limit

High Limit - Production
Medium Limit - Development
Low Limit - Testing
Pay-as-you-go - Overflow

Key Rotation

Best practices:

Rotate keys every 90 days
Use expiration dates
Keep one backup key
Document rotation schedule
Update dependent products

Usage Monitoring

Dashboard Metrics

Track your usage:

Requests - API calls per key
Tokens - Input/output consumption
Cost - Estimated spending
Errors - Failed requests
Latency - Response times

Setting Limits

Protect against overuse:

Set monthly spending caps
Configure request limits
Enable usage alerts
Auto-pause at limit
Review weekly

Usage Alerts

Configure notifications:

50% of limit reached
80% of limit reached
100% limit hit
Unusual activity detected
Key expiration reminders

Provider-Specific Settings

OpenAI Configuration

Special settings:

Organization ID - For enterprise accounts
Model Access - GPT-4, GPT-3.5, DALL-E
Rate Limits - Requests per minute
Fine-tuned Models - Custom model IDs

Anthropic Configuration

Claude options:

Model Selection - Claude 3 Opus/Sonnet/Haiku
Context Window - 100K or 200K
Safety Settings - Content filtering
Beta Features - Early access

Google AI Configuration

Gemini settings:

Model Variants - Pro, Ultra
Safety Filters - Harm categories
Location - Regional endpoints
Quota Management - Per-project limits

Security Best Practices

Key Storage

✅ Do:

Use unique keys per platform
Enable IP restrictions (when available)
Set expiration dates
Monitor usage regularly
Keep backup keys

❌ Don't:

Share keys between users
Commit keys to git
Use production keys for testing
Ignore usage anomalies
Keep compromised keys

Access Control

Limit key permissions:

Use read-only keys when possible
Restrict to specific models
Enable IP allowlists
Set usage quotas
Review permissions quarterly

Incident Response

If a key is compromised:

Immediately revoke in provider dashboard
Generate new key
Update in GreenMonkey
Check usage logs
Notify affected users

Advanced Features

Environment Variables

For developers:

// Use in products
const apiKey = process.env.GREENMONKEY_OPENAI_KEY;
const client = new OpenAI({ apiKey });

Key Aliasing

Create readable aliases:

@production → Main production key
@development → Dev environment
@testing → CI/CD pipeline
@backup → Failover key

Failover Configuration

Set backup keys:

Add primary and backup keys
Enable automatic failover
Configure retry logic
Monitor failover events
Test regularly

Team Key Management (Business+)

Shared Keys

For team accounts:

Team Keys - Shared across members
Personal Keys - Individual use only
Project Keys - Specific to projects
Client Keys - Customer-provided

Permissions

Control who can:

View key names
Use keys in products
See usage stats
Modify settings
Add/remove keys

Audit Logs

Track all actions:

Who added/removed keys
Usage by member
Configuration changes
Failed attempts
Exports

Troubleshooting

Common Issues

"Invalid API Key"

Double-check for typos
Ensure no extra spaces
Verify in provider dashboard
Check expiration
Confirm activation

"Rate Limit Exceeded"

Check provider limits
Upgrade plan if needed
Implement backoff
Use multiple keys
Contact provider

"Model Access Denied"

Verify model availability
Check account tier
Request access
Use alternative model
Review permissions

Debugging Tools

Use built-in tools:

Connection Tester - Verify key works
Usage Inspector - See recent calls
Error Logger - Review failures
Latency Monitor - Check performance
Cost Calculator - Estimate spending

Cost Optimization

Monitoring Spend

Track costs:

Daily spend per key
Model-specific costs
Projected monthly total
Cost per product
Efficiency metrics

Reducing Costs

Strategies:

Use appropriate models (GPT-3.5 vs GPT-4)
Optimize prompt length
Cache common responses
Batch similar requests
Set spending limits

Provider Comparison

Provider	Strengths	Best For	Pricing
OpenAI	Versatility, GPT-4	General purpose	Per token
Anthropic	Long context, safety	Complex tasks	Per token
Google AI	Multimodal, free tier	Experimentation	Free/paid tiers

Integration Examples

Using Keys in Products

// Prompt product example
export async function executePrompt(userApiKey, prompt, variables) {
  const openai = new OpenAI({
    apiKey: userApiKey, // User's encrypted key
  });

  return await openai.chat.completions.create({
    model: 'gpt-4',
    messages: [{ role: 'user', content: prompt }],
    ...variables,
  });
}

Workflow Integration

In visual workflows:

Add "API Key" node
Select key from dropdown
Connect to AI nodes
Key used automatically
Usage tracked

Best Practices Summary

Security First - Rotate keys, set limits, monitor usage
Organize Well - Name clearly, group logically
Monitor Actively - Check usage, costs, errors
Plan Failover - Have backup keys ready
Document Everything - Track what each key does