> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring Your Own Anthropic Key

> AI features run on your own Anthropic key, configured under Settings → Integrations — never a shared KnoxCall key. Here's why, and what happens when a key isn't set.

# Bring Your Own Anthropic Key

KnoxCall's tenant-facing AI features — the workflow **AI step**, the workflow **copilot**, and **AI-assisted route/spec setup** — run on **your own Anthropic API key**. KnoxCall does not fall back to a shared operator key for your AI usage.

This keeps your AI spend on your own account (visible in your Anthropic console, on your billing), and keeps a shared key from being exhausted by one tenant's traffic.

## Add your key

1. Go to **Settings → Integrations → Anthropic**.
2. Paste your Anthropic API key (`sk-ant-…`) and save.

Your key is stored encrypted per tenant (envelope-encrypted under your [tenant master key](/essentials/tenant-kms/overview)) and is only ever used server-side at egress. It is never returned to the browser.

Rotating the key in Settings takes effect immediately — the gateway re-reads it on the next call.

## What happens without a key

Each feature degrades safely rather than silently using someone else's key:

| Feature                                | Without a key                                                                                                                                                 |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Workflow AI step**                   | The step fails with a clear message: *"AI features require your own Anthropic API key. Add it under Settings → Integrations → Anthropic to enable AI steps."* |
| **Workflow copilot** (draft / explain) | Returns `HTTP 402` with code `ANTHROPIC_KEY_REQUIRED`; the builder prompts you to add a key.                                                                  |
| **AI route / spec setup**              | Falls back to KnoxCall's built-in **local heuristics** (no AI) and shows a prompt to add your key for AI-powered analysis.                                    |

## How the gateway uses your key

When a workflow AI step runs, KnoxCall lazily provisions a **system agent** in your AI Gateway and routes the step through it — so first-party AI traffic gets the same [budgets](/ai-gateway/budgets-finops), [firewall](/ai-gateway/firewall), [PII handling](/ai-gateway/pii-redaction), and [usage attribution](/ai-gateway/budgets-finops) as the rest of your AI traffic. Your Anthropic key is mirrored into a KnoxCall-managed secret and injected by the system route at egress; the step authenticates with a short-lived phantom token, never the raw key.

<Note>
  Provider keys for your **own** gateway agents (the ones you create) are configured on their route's injected secret, exactly like any other KnoxCall route. "Bring your own key" here refers specifically to the **Anthropic Integration** that powers KnoxCall's built-in AI features.
</Note>