BYOK for agencies and how to organize client keys

BYOK for agencies raises one question as soon as the second client signs, which is whether you need one API key per client or a single key for the whole agency. The short answer is one key per client, almost always. The full answer covers organization, tracking, rebilling, the GDPR and what happens when a client leaves. It's a very concrete topic in the daily life of agencies and multi-client freelancers. It rarely gets a proper write-up.

One clarification up front for anyone who arrived through the namesake. The keys in question are the API keys of AI providers, the ones that power content production. They have nothing to do with the BYOK of enterprise encryption found in cloud documentation. Those are two worlds that share one acronym, with zero overlap between the two subjects.

01Key takeaways

• One key per client is the right default, with isolated spending, automatic accounting and a clean handover when the client leaves.
• The major providers' consoles offer organizations, projects and spending limits. The tooling for multiple clients already exists, for free.
• Rebilling has two legitimate models, transparent actual cost or a flat fee with a declared margin. The bad model is the one you hide.
• On the GDPR side, the client's own key clarifies the chain of processors instead of muddling it.
• A client's key is never shared in plain text within the team. Simple practices settle this point once and for all.

02Two models, the agency's key or the client's key

In the first model, the agency holds a single key and produces for everyone with it. Simple at the start, this setup mixes consumption together, exposes every client to the same incident and complicates both a client's departure and billing. It holds up for two or three small accounts or one-off assignments. Beyond that it cracks, usually at the worst moment, when the agency no longer has time to reorganize.

In the second model, each client has their own key, created on a provider account in their name or in a dedicated project of the agency. Each client's spending reads on its own statement, incidents stay contained and a departing client gets full independence back in a single administrative step. It's the direct application of the basics of AI without a subscription at the scale of a client portfolio. You pay actual cost, per account, in a readable way.

03Head to head in one table

Operational comparison as of June 13, 2026, with console capabilities cited in the sources

Criterion	Single agency key	One key per client
Spending tracking	Allocation spreadsheet by hand	Provider statement per client, automatic
Incident on a key	All clients affected	Only one client concerned
Spending cap	Global, not very telling	Per client, calibrated on the contract
Client departure	Untangling the histories	Handing over the key, clean and immediate
Rebilling	Estimated	To the cent, justifiable
Setup	Once	Ten minutes per new client

The table leans clearly to the right. The cost of the winning column is ten minutes per new client account, the time it takes to open a key with each provider involved by following the matching guide, coffee included. The only real question left is organization, which the next sections cover.

04Organizing with naming, projects and caps

Three habits are enough. Naming comes first. Each key carries the name of the client and the use, such as clientX-blog or clientX-images, readable in the console as in the tool. It should make sense to you and to the colleague who covers for you during the holidays. Projects come next. The major providers' consoles let you group keys and spending by project or workspace, which is exactly what you need to keep a client portfolio tidy. Their official documentation details the setup.

Caps come last, as the safety net. A spending limit per client, calibrated on the contract, turns any slip into an alert instead of an invoice. The setting takes a minute and lives on the provider side, with the step-by-step in capping spending at the provider. Add the rules for keeping keys safe, which are the same for an agency as for a solo worker. With that the infrastructure is in place.

05Tracking and rebilling, the two honest models

Tracking comes first. With one key per client, the provider's statement IS the cost accounting, call by call and month by month. There's no allocation spreadsheet and no estimate open to dispute. Tracking usage client by client details the dashboards available at each provider.

Rebilling comes next, a subject that rarely gets covered properly. Two models hold up. With transparent actual cost, the agency rebills consumption to the cent with the statement as proof, while its margin lives in its service fees. That's unbeatable for trust and ideal for demanding accounts. With a declared flat fee, a fixed amount with AI included is calibrated above expected consumption. It's easier to sell and perfectly honest as long as it's presented as a flat fee. The only indefensible model is a hidden margin on a cost presented as a pass-through expense.

06A year in an agency, to give a sense of scale

Picture a typical portfolio of ten clients in regular content production, with articles, product pages and visuals. Each client's API consumption sits between one and five euros a month at current price lists. That makes an annual envelope of roughly 120 to 600 euros for the whole portfolio, split automatically by the statements.

Compare that with the management cost you avoid. There's no allocation spreadsheet, no reconciliation meeting and no disputed invoice for lack of proof. The monthly hour of admin you get back is often worth more than the API savings themselves. The two add up and repeat every year with no renegotiation, which makes this one of the rare organizational projects with an immediate and lasting return.

07The GDPR and who processes for whom

In an agency the chain gets more precise. Your client remains the controller of their data, the agency acts as processor and the AI provider acts as sub-processor, framed by its data processing agreements. The client-key setup makes this chain crystal clear. The provider contract is in the client's name, the agency operates and each party signs what concerns it.

The underlying obligations stay unchanged. Send the models only what's needed, put a framework around end customers' personal data and document the setup in the record of processing activities. Ten lines in your service contracts are usually enough to formalize everything, including key ownership, the rebilling model and what happens to data on departure. What matters is choosing the setup before you write them, rather than improvising at the first dispute.

08The team, using keys without exposing them

The last link is your colleagues. The rule fits in one sentence. A client's key never circulates in plain text, neither by messaging nor in a shared document. Serious tools store it in each workstation's browser. Consoles allow separate keys per team member when the need arises, with individual revocation when someone leaves the team. The full practices, rotation included, are in sharing a key cleanly in a team.

09The three costly mistakes, seen from the field

The first is the single key that lingers. Set up as a stopgap for the first client, it survives to the tenth because it works well enough. The day it leaks or needs rotating, every client stops at once. The day a client disputes an invoice, nothing backs it up. Migrating to one key per client takes a quiet afternoon, while the incident that forces an emergency migration costs a week and a few cold sweats in front of clients.

The second is having no cap. Everything is fine until a badly configured automation runs a whole weekend on a client's account. A spending limit turns that scenario into an alert email on Saturday morning. Without it, you face a delicate conversation on Monday. One minute of setup per client when the account opens gives the best prevention-to-price ratio in the whole trade.

The third is the hidden margin, a commercial mistake. It means presenting the client with an inflated AI cost as a rebilled pass-through expense. The transparency of the statements makes discovery almost inevitable. Trust doesn't recover from it. Taking a margin is legitimate because it's the job. Taking it openly, through a declared flat fee or clear fees, is the only lasting version of that legitimacy, especially now that statements can be checked in two clicks.

10The recommended workflow, end to end

1. When a new client signs, create their provider account or dedicated project, a properly named key and a spending limit calibrated on the signed contract.
2. Paste the key into your production tools, which should keep it on the browser side.
3. Work as usual. The provider's statement writes itself, client by client, with no data entry on your part.
4. Each month, glance at the statement and add the rebilling line according to your model, transparent or flat-fee.
5. When a client leaves, hand over their key and account, revoke your own access and archive the full statement. It takes ten minutes with zero disputes.

This routine makes BYOK for agencies a commercial advantage as much as a saving. Transparency sells well against opaque plans, in prospecting as in renewals. OpenTahr's Studio plan, planned for after the beta, is designed for this multi-client way of working, generation, images and direct publishing included. The free account lets you set up your first client in real conditions. For the underlying choice between formulas, choosing between a subscription and a key remains the reference, while leaving a subscription in good order supports the transition.

11Frequently asked questions

Do you need one API key per client or a single one for the agency?

One per client, as soon as the portfolio goes beyond two or three accounts. You get isolated spending and incidents, a statement per client and a clean departure. A single agency key only keeps its appeal for very low volumes or one-off jobs with no ongoing contract.

How do I rebill AI consumption to a client?

You can bill actual cost with the provider's statement as proof and your margin in your fees. You can also bill a flat fee with AI included, presented as such and calibrated above expected consumption. Both hold up commercially. Only a hidden cost presented as a pass-through expense raises a question of fair dealing.

Can the client see their own consumption?

Yes. It's one of the charms of the setup. If the provider account is in the client's name, they can open their own statement at any time. Many agencies turn this into a selling point, as the most verifiable AI invoice on the market. Trust improves on both sides, as do contract renewals, which is no small matter in an agency relationship.

Who owns the key, the agency or the client?

The holder of the provider account owns it. The cleanest setup puts the account in the client's name, with the agency operating as an authorized user. Failing that, a dedicated project in the agency's organization does the job, with an agreed transfer if the client leaves. What matters is writing it down in black and white in the service contract, at signing, when everyone is in a good mood.

What happens when a client leaves the agency?

With one key per client, you hand over the account and the key, revoke your access and archive the statement, ten minutes in all. The client leaves with their history and their independence. The agency has nothing to untangle and keeps a reputation for clean work. This scenario alone justifies the model, because you choose your organization for how contracts end as much as for how they start.

Transparency note. Console capabilities (organizations, projects and spending limits) are summarized from the providers' official documentation consulted on June 13, 2026, listed in the sources. They change, so the official pages are the reference. None of the providers named here pays us.

12Sources

1. OpenAI, official platform best practices (organizations, projects, limits)
2. Anthropic, official help center (workspaces and key management)