Run simulations on your own AI provider account (BYOK)

By default, simulations run on Cesura's own AI models. An organization can instead run them on an AI provider it controls. This is often called BYOK (Bring Your Own Key), and it is what you want when your model usage has to sit on a contract, an account or a data agreement you already hold.

There are two ways to connect:

Your Google Cloud (Vertex AI): Gemini runs in your own Google Cloud project, in the EU or Israel, billed to your Google Cloud account. Cesura recommends this for universities. See Connect your Google Cloud project (Vertex AI).
API key: use your own key from Google AI Studio, OpenAI, Anthropic or OpenRouter. This article covers this option.

Before you start

Cesura has to enable BYOK for your organization. Until it does, AI Providers does not appear under Organization Management. Ask through Contact support in the sidebar.
You need to be an organization administrator.
Have an API key ready from one of the supported providers below.

⚠️ Once your organization is switched to its own credentials, it no longer uses Cesura's models. Simulations fail until you add a working key and select a model. Set both up in one sitting.

The AI providers page

Open Organization Management → AI Providers. The page walks you through three steps, and a status bar at the top tells you whether simulations can run, and on which model. When something is missing, the status bar names the step to fix.

Choose how to connect: pick API key.
Add your API key.
Choose a model.

If you switch methods, the other method's saved keys or connection stay stored but are not used.

Supported providers

Provider	What the key is
OpenAI	A standard OpenAI API key. An OpenAI-compatible endpoint can be used too — see API base URL (optional) below.
Anthropic	A standard Anthropic API key.
Gemini (Google AI Studio)	A Google AI Studio Gemini API key.
OpenRouter	An OpenRouter API key. It runs in Automatic mode by default — see OpenRouter keys and Automatic mode below.

Vertex AI does not use an API key. To run Gemini in your own Google Cloud project, choose Your Google Cloud (Vertex AI) in step 1 instead. Amazon Bedrock is not supported.

Add an API key

In step 2, click Add API key.
Choose the Provider and paste the API key.
Optionally set an API base URL (optional) — an override endpoint for OpenAI-compatible providers. It must be HTTPS, and it must resolve to a public address. For OpenRouter, the EU endpoint (https://eu.openrouter.ai/api/v1) serves fewer models than the main one, and no AI image models.
Click Add API key. The key is listed with its provider, the last few characters of the key, and a Status.

Keys are encrypted and never shown again. When you edit a credential the key field is left blank on purpose: leave it blank to keep the stored key, or paste a new one to replace it.

Status, and testing the connection

Status	Meaning
Unverified	Stored, but not tested yet. New keys, and keys you replace, start here.
Verified	The last Test connection succeeded. The row also shows what it was Verified for.
Rejected	The provider refused the last Test connection — usually a revoked key, a typo, or no quota on the account.

Use Test connection to check a key without waiting for a learner to hit the problem. The dialog asks for a Model to test (LiteLLM route): the provider prefix, a slash, then the model name — for example openai/gpt-4o-mini. If you already selected a model for that provider, the test uses it directly, without asking. The route has to start with the prefix of the key you are testing; testing an Anthropic model against an OpenAI key is refused rather than silently failing.

For an OpenRouter key, the test also checks document search, and the key's row then shows the result, for example “Document search: available on this key.”

Choose a model

In step 3, pick the Model this organization's simulations run on, then click Save model selection. Cesura offers a curated list of current flagship models per provider, and only for providers you have added a key for — selecting a model with no matching key is refused.

Until a model is selected, the status bar says simulations can't run.

OpenRouter keys and Automatic mode

When you add an OpenRouter key, step 3 selects Automatic for you, unless your organization already has a model selected. In Automatic mode, each feature runs the model Cesura runs it on, through your OpenRouter key. When Cesura changes a model, your organization follows with nothing to change.

Pin one model instead. Pick another OpenRouter model in Model and click Save model selection. Every feature then runs on that model.
Cesura checks your key. When Automatic starts on a key, Cesura checks which of its models the key can use. This takes about a minute, and the status bar says so while it runs. Test connection runs the same check straight away.
Models your key can't use are listed, for example “Not available on this key: … Automatic runs those features on another model.”
A model that refuses a request during a run is skipped for an hour, and the feature runs on the next model in line. If every model fails, the request fails.
Data retention and region follow your organization's own OpenRouter account settings. Cesura sends no routing or data policy of its own to OpenRouter.

What this changes, and what it doesn't

AI usage bills to your provider account, not to Cesura. Nothing ever falls back to Cesura's account. If your provider can't serve a feature, that feature doesn't run.
An OpenRouter key runs every AI feature except live voice calls, including AI images and document search.
A Google AI Studio, OpenAI or Anthropic key runs text simulations, but it cannot run live voice calls, AI images, Advanced Analysis, document search, or building and translating simulations. For those, use OpenRouter or Your Google Cloud (Vertex AI).
Video avatars and voice previews are off for every organization that runs on its own AI provider, because both would run on Cesura's account. Video simulations run with audio and the character's portrait instead.
Your credit pool is unlimited. Because your organization pays its AI provider directly, the credit pool shows ∞, and there is no button to buy or add credits. User budgets and project budgets still cap what each person and each project can spend. See Credits & billing.

If something goes wrong

Message	What to do
No API key is configured for this provider	Add a key for that provider before selecting one of its models.
This organization is not enabled to use its own AI provider credentials	BYOK is off for the organization — ask Cesura to enable it.
That credential no longer exists	Someone deleted it in another session. Refresh the page and try again.
This model belongs to a different provider than the credential you're testing	Use a route that starts with that key's provider prefix.
This organization is BYOK-enabled but has no usable model configured	Add a working key and select a model — simulations cannot run until both are in place.
We could not confirm your organization's AI provider settings. Try again in a moment.	Cesura couldn't read your settings just then. Your setup is not the problem. Try again in a moment.
The key was not sent. The URL must use https and must resolve to a public address.	The API base URL (optional) points to a private or internal address. Use the provider's public endpoint.
The key was not sent. … could not be resolved. Check the hostname is spelled correctly and has a public DNS record.	Check the spelling of the API base URL (optional).

Learners who try to start a simulation before the setup is complete see AI provider not configured and are asked to contact their administrator.

If simulations start failing on a key that worked before, run Test connection. A Rejected result usually means the key was revoked or the provider account ran out of quota. Fix it at the provider, then test again before learners hit the problem.