BYO LLM keys
Aroovo never pays a customer's LLM bill. Every Brand brings their own provider key — Anthropic, OpenAI, OpenRouter, or OpenClaw — and every Tenant under that Brand transparently routes Messages API calls signed with the Brand-Owner's key. No platform proxying, no surprise margin compression at scale.
Supported providers
| Provider | API shape | Why a Brand picks it |
|---|---|---|
| Anthropic | Messages API native | Default. Best tool-use behaviour, frontier Claude models. |
| OpenAI | Chat Completions | Existing OpenAI relationship; mix GPT-4o with Claude for cheap-routing-and-expensive-synthesis patterns. |
| OpenRouter | OpenAI-compatible | One key, ~150 models across providers including Gemini, Mistral, and frontier OSS. |
| OpenClaw | OpenAI-compatible (self-hosted) | Self-hosted gateway with custom base URL. Avoids first-party Anthropic billing entirely. |
Where keys live
Provider keys are stored in the encrypted Secret table scoped by brandId. The wire format on Brand.providerConfigJson is a JSON blob of secret references, e.g. { anthropicKeySecretRef: "anthropic-key-acme", openclawBaseUrl: ... }. The runtime looks up the referenced secret, decrypts it via AES-256-GCM keyed by SECRETS_ENC_KEY, and uses it for the outbound call. Keys are never logged, never returned over the API, never embedded in audit rows.
Per-agent provider choice
Each Brand can route specific agents to specific providers. A common pattern: cheap fast model (Haiku, GPT-4o-mini) for the orchestrator and routing agents; frontier model (Sonnet, GPT-4o) for the synthesis agents that compose customer-facing replies. See ADR-001 §Phase 3 for the provider abstraction details.
Quota errors are surfaced
Provider-side quota errors (Anthropic 429, OpenAI rate-limit, OpenRouter credit exhausted) surface to the Brand-Owner inside the operator console — no silent failure, no support-ticket roulette. The per-tenant spend cap auto-pauses the offending Tenant only, so a runaway agent in one Tenant can't lock the rest of the Brand out.
Flat-rate alternative (OpenClaw + ChatGPT subscription)
Operators who want a flat monthly bill on a heavy-use agent instead of a metered API line can route that one agent through OpenClaw, with their own ChatGPT Pro (or Claude Pro) subscription connected on the OpenClaw side. Aroovo never holds the consumer auth; OpenClaw handles the subscription connect, and the platform just dispatches turns through them — the relationship is operator ↔ OpenClaw ↔ the model vendor. Costs show as $0 in /costs for those rows (with a small BYO tag) because the spend lives in OpenClaw's billing, not yours. Full procedure in the how-to Flat-rate inference via OpenClaw + a ChatGPT subscription.