Models and personal BYOK
Choose approved models and connect your own provider credentials without sharing them with colleagues.
Three sources of models
| Source | Who configures it? | Who can use it? |
|---|---|---|
| Provided by CogLake | Your organization enables the offered models | Members permitted by the organization and their role |
| Organization BYOK | An authorized administrator connects a provider | Members covered by its model and provider rules |
| Personal BYOK | You connect your own provider in personal settings | You, subject to organization and role permissions |
BYOK means using your own provider API key or a supported account connection. It does not remove CogLake plan requirements. Provider usage is billed or limited by that provider, not automatically included in the CogLake plan.
Add a personal connection
- 1Organization allows personal BYOK
- 2Role permits personal connections
- 3Connect and test provider
- 4Choose an available model
- Open your personal settings and the personal model connections section.
- Select Add connection and choose a provider offered in this installation.
- Enter the requested credentials and, where offered, the provider endpoint.
- Test the connection and review the detected models before saving.
- Return to a chat and select an available model from that connection.
Your private key is not a company-wide key. Do not enter it into a shared chat, a skill description or an agent instruction. Removing a permission or disabling a provider can stop its use even if the credential is still stored.
Organization controls
Administrators manage organization connections, CogLake-provided models and whether personal connections are allowed. A user's role must also permit personal BYOK. For example, an organization-wide allowance does not by itself enable it for every member.
Changing these model permissions is different from choosing how source documents are processed. OCR, transcription and other installation-level processing are managed by the service operator, not by a tenant's model list.
API key or subscription account?
A normal API key and a subscription sign-in are different connection types. A subscription does not automatically include API credit. Use only the connection types actually offered by CogLake. Some account-based connections are personal-only or limited to selected installations/users; an absent option is not an invitation to paste session cookies or tokens.
Local provider options depend on deployment. A private endpoint requires operator approval; changing the URL cannot bypass network restrictions.
Replace or remove a key
Open the saved connection to update its credentials, retest available models or remove it. Removal may interrupt future use by tasks that selected that connection. Review scheduled work first. Never send the key to support.
Common problems
| Message or symptom | What to check |
|---|---|
| Personal connection is not allowed | Organization policy and your personal-BYOK role permission |
| Key rejected | Correct provider, key permissions, expiry and provider account |
| Connection works but no models appear | Models supported by the connection and allowed by the organization |
| Rate limited | Provider quota; wait rather than repeatedly resending |
| A previously selected model disappears | Provider/model availability, connection owner and changed permissions |