Separate secrets from versions
An API key is workspace infrastructure, not part of an agent's behavior. Embedding it in prompt or configuration JSON risks copying it into drafts, immutable versions, API responses, fixtures, and debug output. Runovio accepts an OpenAI key only through Settings and stores it in a dedicated workspace credential record.
The plaintext key is encrypted at rest with AES-256-GCM using a server-only encryption key. Agent versions store the selected provider and model but never the credential. The full key is not returned to the browser, and it is excluded from traces and application logs.
Credential lifecycle
Adding a key enables configured, allowlisted OpenAI models for that private workspace. Replacing the key writes new ciphertext; it does not require republishing agent versions because those versions do not pin a secret. Removing it deletes the workspace credential and disables OpenAI execution. Local Stub remains available.
The deployment encryption key is operationally critical. Losing it makes existing workspace credentials unrecoverable. Operators should generate it from 32 random bytes, keep it server-only, and plan any rotation by clearing or re-entering stored credentials. See the BYOK guide for the product workflow.
Billing and no-key operation
Runovio has no deployment-wide OPENAI_API_KEY fallback. One workspace cannot accidentally spend
another workspace's credential, and a missing user key does not silently shift cost to the operator.
OpenAI bills the OpenAI account associated with the supplied key separately from Runovio.
This distinction also matters for cost reporting. Runovio may estimate a run's model cost from token usage and a dated pricing snapshot, but that estimate is not an OpenAI invoice. Provider-side discounts, taxes, account terms, or later adjustments are outside the estimate.
Teams that want deterministic development without a paid provider can use Local Stub. When they are ready for native execution, they can add a key, run a small reviewed agent, inspect usage, and remove the key afterwards. Explore the BYOK feature and cost tracking.