Bring your own key
Use your own model provider credentials with Hull, either directly in your editor and CLI or through Hull Gateway.
Hull Gateway is the default way to use models in Hull: sign in and you get managed access with Auto routing. If you already have an account with a model provider, you can use your own credentials instead. There are two ways to do it.
| Approach | Where the key lives | Who it's for |
|---|---|---|
| Connect a provider directly | On your machine, in Hull Desktop, your IDE or the Hull CLI | Individuals who want to use their own provider account locally |
| BYOK through Hull Gateway | Encrypted in your Hull account or organization | Using your provider billing while keeping Hull Gateway features such as cloud agents and code reviews |
Connect a provider directly
Hull Desktop, the VS Code extension, the JetBrains plugin and the Hull CLI can call model providers directly with your own API key, OAuth sign-in or cloud credentials. Requests go from your machine to the provider, and the provider bills you.
Open Settings, go to Providers, choose Add provider, pick the provider and enter your credentials.
Models from a directly connected provider appear in the model picker under that provider, for example anthropic/claude-sonnet-4-5. These requests don't go through Hull Gateway, so Auto routing, Gateway usage tracking and organization model policies don't apply to them. See Providers for setup steps for each provider.
BYOK through Hull Gateway
With Gateway BYOK, you store a provider key in your Hull account. When you select a Hull Gateway model from that provider, Hull Gateway sends the request with your key, and the provider bills you instead of the usage counting against your Hull allowance. Cloud features that run on Hull Gateway, such as cloud agents and code reviews, can use the key too.
Organizations
For organizations, Enterprise BYOK is available through an Enterprise agreement, alongside managed Hull Gateway, model policies and SSO. Contact sales@withhull.com or see pricing.
Add a key
- Sign in at app.withhull.com and select your personal account or the organization.
- Open Bring Your Own Key (BYOK) in the sidebar. For an organization, this page is available to owners.
- Add a key, choose the provider and paste your credentials.
- Save. You can test, disable, replace or delete a key from the same page.
Keys are encrypted at rest. The dashboard never shows a saved key again.
Supported providers
Standard provider keys:
- Anthropic
- AWS Bedrock
- Azure Foundry (experimental)
- DeepSeek
- Fireworks
- Google AI Studio
- Google Vertex AI
- Inception
- MiniMax
- Mistral AI
- Moonshot AI
- Novita
- OpenAI
- Perplexity
- xAI
- Xiaomi (pay as you go)
- Z.ai (pay as you go)
Coding plans and direct provider plans (bring the key issued by your plan to use its included models):
- Alibaba Token Plan (Singapore)
- BytePlus Coding Plan
- Chutes BYOK
- CrofAI
- Eden AI
- Inceptron BYOK
- Kimi Code
- Martian
- Morph BYOK
- Neuralwatt
- NVIDIA BYOK
- Ollama Cloud
- OpenCode Go
- OrcaRouter
- Synthetic
- Xiaomi Token Plan (Europe)
- Xiaomi Token Plan (Singapore)
- Z.ai Coding Plan
The dashboard shows the current list and the models each key unlocks.
Structured credentials
A few providers take a JSON value instead of a single key.
AWS Bedrock accepts a Bedrock API key and region:
{ "apiKey": "...", "region": "us-east-1" }or IAM credentials:
{ "accessKeyId": "...", "secretAccessKey": "...", "region": "us-east-1" }The IAM user needs bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream.
Google Vertex AI takes a project, location and service account:
{
"project": "...",
"location": "global",
"googleCredentials": { "clientEmail": "...", "privateKey": "..." }
}Enable the Vertex AI API and grant the service account permission to invoke the models you use.
Azure Foundry takes an API key and the resource name (the subdomain of your Azure OpenAI endpoint):
{ "apiKey": "...", "resourceName": "my-resource" }How Gateway BYOK works
- When you select a Hull Gateway model, Hull checks for an enabled BYOK key for that model's provider and uses it if one exists.
- If your key fails (for example, it's invalid or out of funds), the request fails. It does not fall back to Hull's keys.
- Coding plan keys only unlock the models included in that plan.
- In the model picker, Hull Gateway models that can use one of your enabled keys show a BYOK badge. The badge doesn't apply to models from directly connected providers.