BYOK or included AI allowance: two business models for the same product

An AI tool can bill the same workflow in two ways. BYOK here means a customer-supplied API key. This secret access code lets the product call the AI provider through the customer account using a programming interface, a connection between programs. The provider charges usage to that account. With an included AI allowance, the product operator pays the provider and includes a limited amount of usage in the product price. Setup, error handling and protection of the key remain product responsibilities in both cases.

BYOK: a separate AI invoice and extra setup

BYOK can suit a technically experienced audience with an existing provider account. Without that experience, setup adds steps: creating an account, generating a key, limiting spending and understanding errors. A lower product price can therefore cost more setup time.

The data route needs an explicit description. A browser application may send requests directly to the AI provider. Another design passes the key and input through the product operator’s server. A third uses a customer-operated intermediary server, often called a gateway. These designs give different parties access to data. BYOK selects none of them and does not mean that AI runs on the customer’s computer.

Included allowance: easier setup, limited costs

An included allowance avoids an extra provider account. The operator pays billable usage; retries after errors can also create charges. A per-account cost limit only constrains generous promises if it is actually enforced. Before a job starts, an amount can be reserved from the available allowance. This prevents parallel jobs from each spending the same remaining amount. After completion, the reservation is reconciled with actual costs. Extra packs need a clear price and scope.

A fair comparison uses the same successfully completed work. BYOK costs include both the product price and the external AI invoice, plus setup and assistance time or charges. A package includes AI usage only within its promised allowance; extra usage can change the comparison.

Worked example: what remains after costs

A hypothetical monthly example uses euro amounts excluding tax. The package costs €29, with €8 of AI costs and €3 of other variable costs. Ten support minutes at €30 per hour cost 10 ÷ 60 × €30 = €5. The remainder is €29 − €8 − €3 − €5 = €13 of contribution. This is revenue after the stated variable costs, not profit: payment fees and fixed operating costs are still missing.

The BYOK version costs €19 in the same example. The operator pays no AI invoice but provides 20 support minutes: 20 ÷ 60 × €30 = €10. With €3 of other variable costs, €19 − €10 − €3 = €6 remains. The customer pays the €19 product price plus an assumed €8 to the AI provider, totaling €27, with administrative time on top. The cheaper product invoice therefore does not automatically mean more remaining revenue for the operator or less work for the customer.

If an experienced audience needs only five support minutes, support costs fall to €2.50. BYOK then leaves €19 − €3 − €2.50 = €13.50. These are freely chosen assumptions, not measured market figures. All costs refer to the same month; one-off setup costs need separate allocation for longer comparisons. The linked calculators help explore such assumptions.

Safe key handling and replacement

An operator’s secret provider key must not appear in JavaScript delivered to browsers, where it could be read. The Anthropic TypeScript SDK, a library for connecting to the service, therefore disables browser operation by default. [1] An explicitly supplied customer key also requires a clear account of where it is processed and how access can be withdrawn.

Keys stored on the product server need separate management for each customer and encryption at rest. Access belongs only to necessary program components and authorized people. A key must be replaceable and revocable at the provider; removing it from the product alone does not revoke it at the provider. Logs may contain an internal identifier, not the secret. The same applies to error reports, support attachments and analytics events.

BYOK does not prevent expensive repetition: a faulty workflow could keep sending the same paid request. OWASP describes unlimited resource consumption as a risk that also affects paid external services. [2] Both models therefore need limits on jobs, retries and concurrent requests. A cost alert only informs; an effective spending limit must stop further jobs.

Combining both models with clear costs

A mixed model can include a small starting allowance and offer BYOK later. The transition needs a clear cost display and an explicit choice: which account pays for the next job, and how much usage is included?

Automatic switching from a customer key to the operator’s budget can create unexpected costs. A stopped job with an explained next step is easier to understand. A pilot with a small test group records setup time, the first useful result, support time and actual total costs. Both versions need comparable tasks and observation periods.

Sources

1. Anthropic: TypeScript SDK and browser credentials
2. OWASP API4: unrestricted resource consumption

Sources checked: 25 October 2026.