The ten providers
Only an ADMIN can add, replace or remove a key. Any member can see which providers are configured.ai-coustics is not an API key. It issues a signed SDK licence of the form
<payload>.<signature>, and that whole string is what you paste. A bare API key copied out of the middle of it is rejected with a message telling you so.Adding a key
In the dashboard: Build → BYOK. The page lists all ten providers, whether each has a key, and — for the four providers that publish one — the name of the account behind it. Click a row, paste the key, save. Over the API it isPUT /v1/byok/{provider}, where {provider} is the lowercase id from the table above (openai, elevenlabs, aicoustics, …).
The key is proved before it is stored
Talqing calls the provider with the key you just pasted and refuses to write the row unless the provider accepts it. There are exactly three outcomes:
Because nothing is written on a failure, rotating onto a bad key leaves the working key in place. Your agents keep running on the old key while you go and find the right one. The same is true of a provider outage: a 502 here means we could not check, not that your key is bad, and retrying costs one click.
xAI is the strictest of the ten. It reports a key it still recognizes but will not serve, so a blocked or disabled key is refused with “xAI accepted this API key but this key is blocked.” rather than stored and left to fail on the first turn.
Keys are write-only
A stored key is never returned, by any endpoint, to anyone. A read gives you the last four characters and the account label:account_label is whatever the provider calls the account. Four of the ten publish one — xAI, OpenAI, ElevenLabs and Deepgram — and the other six return "". An empty label means the provider says nothing about its accounts, not that something failed.
There is no rotation ceremony: PUT the same provider again with the new value. Agents pick up the new key on their next run.
What happens without a key
Publishing is refused, and the error names the provider. Validation returns one error per missing provider:- It runs only at publish, never on a draft save. You can build an entire agent against a provider you have not configured yet, and the refusal arrives when you try to make it live. That is deliberate — a half-built draft should not be blocked on a credential — but it means a draft that saves cleanly is not proof it can be published. Run validation to find out early.
- It also gates agent tasks, which have no publish step at all. A task is checked when you run it, and the message ends “…add one under BYOK before running this task”.
What happens if you delete a key
Deleting is alsoDELETE /v1/byok/{provider}, ADMIN only, and returns 404 if there was no key to remove.
Where Talqing does use its own keys
Three things run on our account rather than yours, and none of them is an agent:- The CoPilots in the agent, tool and knowledge editors — their model calls are ours, and they are never billed to you.
- The knowledge base builder, which reads and transcribes your crawled pages.
- The voice and avatar galleries, so the editor has something to show before you have stored a key for that provider. Once you store one, the gallery browses your own account, which is what makes a voice you cloned yourself pickable.
Models
Which providers each model slot can draw from, and what each costs.
Pricing and credits
What Talqing charges on top of your own provider spend.