Skip to content
All documentation

Bring Your Own Model (BYOK)

Point your org's Prism generation and exercise grading at your own OpenAI-compatible endpoint, OpenAI, Azure OpenAI, or any compatible provider, with your own key and model.

What it is

By default, Prism and grading run on the platform key. BYOK lets an org admin configure their own OpenAI-compatible endpoint (base URL + key + model, plus an Azure api-version) so their org's AI usage bills to their own account and can use any model their provider offers.

Use

  • When a custom endpoint is configured, all of the org's Prism generation (courses, blocks, survey questions) and exercise grading route through it.
  • If no endpoint is set, the platform key is used automatically.

Setup

Open Admin → Organization Settings. Choose a provider (OpenAI-compatible or Azure), enter the base URL, model name, API key, and (Azure only) an api-version. Save to activate; Remove to fall back to the platform key.

# OpenAI-compatible
base URL:  https://api.openai.com/v1
model:     gpt-4o-mini

# Azure OpenAI
base URL:  https://<resource>.openai.azure.com/openai/deployments/<deployment>
api-version: 2024-06-01

Security

  • The API key is encrypted at rest with strong, industry-standard encryption (AES-256-GCM), keyed by a secret derived from your environment; there is no hardcoded fallback.
  • The key is write-only: the API returns metadata only, never the key, and it is never logged or echoed.
  • Base URLs are guarded against SSRF: loopback, private (RFC-1918, CGNAT), link-local, and cloud-metadata addresses are rejected, and the host is resolved once and pinned at connect time to defeat DNS rebinding.
  • Config is org-scoped; a tenant's key can never be read or used by another org.