Skip to main content
Bring your own keys connects a workspace to an account your team holds with a provider. Managed access uses Deepline credentials where the action supports that mode. The difference concerns access and billing ownership; it does not change what evidence the workflow needs to accept a result.

​
A connection is scoped, not universal

Connections belong to a workspace. Deepline restricts connecting integrations to workspace owners and admins, and each provider defines its supported credential form or authorization flow. Some need multiple fields; OAuth uses a different procedure from a simple API key. An existing connection does not imply that every action supports BYOK or that managed access is available as a fallback. Eligibility and prices belong to the specific action contract. A workflow with several providers may therefore have several access modes. Local provider environment variables are also a different boundary. They are not a way for a hosted CLI request to connect your provider account. The hosted workspace uses its connection flow.

​
Account ownership does not establish result quality

Suppose a team already has a provider contract for company research. Using that account can preserve its existing procurement arrangement, but the returned employee count may still be dated or refer to a parent company rather than the requested business unit. The workflow needs the same identity, freshness, and validation rules whether access is managed or BYOK. A paid contract is evidence of access, not evidence that a particular answer is suitable for a particular decision.

​
Provider billing and workflow cost remain distinct

For requests using a BYOK connection, the provider bills your account under your agreement. Deepline compute or other applicable usage charges can still apply. Managed access follows the operation’s Deepline pricing contract. A fair comparison includes the cost of an accepted outcome, not just one call. Retries, validation, unused contract capacity, maintenance, and manual repair can change the economics. Some of those costs are team-owned measurements, not fields Deepline automatically computes. Deepline exposes its customer charges, not its internal provider spend. Your provider invoice is a separate source for evaluating a BYOK contract.

​
Credential control and data-use permission are separate

An authorized connection allows supported requests. It does not establish that all returned data can be retained, shared, or used in every downstream context. Those permissions depend on the provider agreement and the team’s policy. Similarly, a centralized connection does not prove that every workflow has a field-level approval gate. The product’s connection permissions and a team’s operating policy solve different problems. Workflow code still needs to limit which results reach external systems.

​
Mixed access requires an explicit interpretation

A route may use one BYOK source and another managed source if their contracts permit it. The useful record is which action actually ran, which result it produced, and which applicable charges were recorded. A team should not infer that a rejected BYOK request will silently become a managed request. A change of access mode can change account permissions, contract terms, and usage. Supported behavior must come from the live action contract rather than a general assumption about BYOK.

​
Apply this understanding