Skip to main content
You can add one or more AI provider API keys of your own to your Ankra profile. Ankra then runs the AI work you start yourself - your chats and the reviews of your pull requests - on those keys, in the order you choose. The provider bills your account, not your organisation’s, and none of it draws on your organisation’s free monthly allowance. Your keys are yours alone. They never serve another member’s work, and nobody else in the organisation can see or use them.

​
What runs on your keys

Which model answers:
  • An Anthropic key runs Claude. When the chat’s model is one Anthropic does not serve, such as Kimi K3 or GLM 5.3 on the Ankra default catalog, your turn runs on the Claude model of the same tier instead.
  • An OpenRouter key runs the model the chat would have used anyway.
  • A model your organisation serves from its own endpoint, and the DevOps AI model, always run where the organisation set them up. Your keys are not used for them.
Reviews run on Claude on either kind of key.

​
Which keys work

  • Anthropic: an API key from the Claude Console (it starts with sk-ant-api). Some Claude plans come with monthly API credits that land in the Console organisation linked to your Claude account; an API key from that organisation spends them. See Anthropic’s API credits for subscribers.
  • OpenRouter: an API key from openrouter.ai (it starts with sk-or-).
Ankra refuses a Claude subscription token (the kind claude setup-token creates, starting with sk-ant-oat) and Anthropic admin keys. Anthropic does not allow other services to store or use Claude subscription credentials, so only Console API keys can be added. Every API key of one Console organisation shares the same balance, so a second key from the same account adds no credit. Ankra refuses it and asks you to add a key from a different account instead. You can add up to 10 keys.

​
Add a key

1

Open your AI keys

Your AI keys are in the new Ankra portal (/next on your portal’s address). Open the profile menu in the sidebar, select Profile, then Connected accounts. Your AI keys is below your GitHub and Bitbucket connections.
2

Add the key

Select Add a key, choose the provider, paste the key and, if you like, give it a label such as Personal Max plan. Ankra checks the key with the provider before saving it, so a mistyped or revoked key is refused straight away.
3

Set the order

Move the keys up or down. Ankra tries them from the top.
4

Check it is used

Send a message in the AI chat. The key’s Last used time updates once it has answered.
Test, in a key’s options menu, checks the key with the provider again at any time, and puts a key that works again back in service. The same menu renames or deletes a key.

​
From the command line

The Ankra CLI does the same with ankra ai keys, signed in as you with ankra login:
A key is named by its label or its ID. add never takes the key as a flag, because a flag ends up in your shell history. It asks for the key, or reads it from a pipe with --key-stdin:
The provider is worked out from the key itself, and a Claude subscription token is refused before anything is sent. Every command takes -o json.

​
From an MCP client

An AI assistant connected to the Ankra MCP server with your own token can show your keys, test one, rename one, change the order or remove one. To add a key, it gives you a link to Your AI keys, where you paste the key yourself. Never paste a key into a conversation: conversations are stored, and Ankra’s tools refuse any call that carries a key. Renaming, reordering and removing a key, and the administrator’s switch, need a token with mcp:write; a read-only token sees only the first three tools. These tools only ever act on the keys of the person whose token it is: background agents, scheduled runs and service accounts cannot use them.

​
When a key runs out or is rejected

Ankra tries your keys in order. A key the provider refuses is skipped and marked on your profile: What that means for your work:
  • A chat moves to your next key if the failing key had not started answering yet. When every key has failed, the turn ends with a message saying why. Nothing is sent to any other account in the middle of your conversation. Send your message again to run it on your organisation’s AI, or fix your keys first.
  • A review that none of your keys could answer continues on your organisation’s AI, under its normal rules, so the pull request is not left unreviewed.

​
Reviews of your pull requests

Reviews only run on your keys when Ankra can tell, for certain, that the GitHub account is yours. Verify your GitHub identity by signing in with GitHub under Profile → Connected accounts (in the classic portal, Profile → General → GitHub Connection). A GitHub username typed in by hand is not enough, because anyone could type yours. Who pays for a review:
  • When you mention Ankra in a comment, the reply or review you asked for runs on your keys, whoever opened the pull request.
  • An automatic review of a pull request runs on the keys of the person who opened it.

​
Usage and limits

  • Spend on your keys is billed by your provider and is not part of your organisation’s Ankra usage. It never draws on the free monthly allowance, so your chats and reviews keep running on your keys after the allowance is used up.
  • Spend on your keys does not count toward the organisation’s daily spend cap either. While the organisation is over its cap, though, AI chats pause for everyone, your own keys included.
  • When AI is paused for the whole organisation - an admin paused it, or the account’s credit or invoices put it on hold - your keys do not get around that.

​
For organisation admins

Members can use their own keys by default. To turn that off, open Ankra AI → Models and provider in the new Ankra portal and, under Members’ own AI keys, switch off Members can use their own AI keys. Changing it needs permission to manage the organisation’s AI. Members’ keys stay on their profiles, marked Not in use, until you switch it back on. From the CLI, ankra ai keys policy shows the setting, and ankra ai keys policy disable and ankra ai keys policy allow change it. An organisation running its own OpenAI-compatible endpoint keeps all AI traffic on that endpoint, so members’ keys are never used there.

​
Security

  • Keys are stored in Ankra’s secret store (HashiCorp Vault or OpenBao) and never shown again. Your profile shows only the key’s last four characters.
  • Only you can add, change or remove your keys: from your own browser session, with your own token in the Ankra CLI, or from your own MCP client, which can change and remove a key but never add one. A service account’s token cannot, a token whose scopes allow no changes cannot, an AI agent working on its own cannot, and neither can Ankra support acting on your account.
  • Deleting your account deletes your keys.

​
Next