All documentation

Bring Your Own Model (BYOK)

Point your org's Prism generation and exercise grading at your own OpenAI-compatible endpoint — OpenAI, Azure OpenAI, or any compatible provider — with your own key and model.

What it is

By default, Prism and grading run on the platform key. BYOK lets an org admin configure their own OpenAI-compatible endpoint (base URL + key + model, plus an Azure api-version) so their org's AI usage bills to their own account and can use any model their provider offers.

Use

  • When a custom endpoint is configured, all of the org's Prism generation (courses, blocks, survey questions) and exercise grading route through it.
  • If no endpoint is set, the platform key is used automatically.

Setup

Open Admin → Organization Settings. Choose a provider (OpenAI-compatible or Azure), enter the base URL, model name, API key, and (Azure only) an api-version. Save to activate; Remove to fall back to the platform key.

# OpenAI-compatible
base URL:  https://api.openai.com/v1
model:     gpt-4o-mini

# Azure OpenAI
base URL:  https://<resource>.openai.azure.com/openai/deployments/<deployment>
api-version: 2024-06-01

Security

  • The API key is encrypted at rest with AES-256-GCM, keyed by scrypt derived from LLM_KEY_ENC_SECRET (falling back to JWT_SECRET); there is no hardcoded constant fallback, and encryption fails closed only if neither secret is present.
  • The key is write-only: the API returns metadata only, never the key, and it is never logged or echoed.
  • Base URLs are guarded against SSRF: loopback, private (RFC-1918, CGNAT), link-local, and cloud-metadata addresses are rejected, and the host is resolved once and pinned at connect time to defeat DNS rebinding.
  • Config is org-scoped; a tenant's key can never be read or used by another org.