Bring your own Anthropic key

Every LLM-powered surface runs on YOUR Anthropic key, not Goable's. Goable holds no shared key, doesn't pay for your usage, and doesn't sit between you and Anthropic's bill.

The model

Goable's core is deterministic physics — no LLM in the scoring path, ever. A handful of surfaces layer natural-language explanation or reasoning on TOP of a score that's already been computed: narrating why a verdict came out the way it did, briefing a multi-slot day, or producing a personalized go/no-go sentence. Those surfaces call Anthropic's API. Instead of Goable operating one shared key and absorbing the bill across every tenant, each tenant sets their own key once, and every LLM call for that tenant runs against it — Anthropic invoices you, not us.

Which features need a key

Everything else on the API — /v1/score and its variants, /v1/recommend-spot, historical, portfolio, projections, underwriting, observations — works with zero Anthropic configuration. Only these five surfaces touch an LLM, and only the LLM part of each is affected by a missing key:

Get an Anthropic key

Create an account at console.anthropic.com, add billing, and generate an API key (starts with sk-ant-). That's an Anthropic account and an Anthropic bill — Goable never sees your payment details and never marks it up.

Load it into Goable

Set it from the tenant portal at console.goable.io/portal/settings — paste the key into the AI / LLM key card and save. Programmatically, the same three calls back the portal card:

PUT /v1/tenant/llm-key
{ "apiKey": "sk-ant-…" }

// → 204 on success, 422 LLM_KEY_INVALID if Anthropic rejects it

GET /v1/tenant/llm-key
// → { set: true, last4: "wxyz", setAt, lastValidatedAt }

DELETE /v1/tenant/llm-key
// → 204, hard-deletes the stored key

PUT makes one cheap, real Anthropic call before storing anything, so an invalid or access-less key is rejected immediately (422 LLM_KEY_INVALID) rather than failing silently on the next real request. Because that validation call is billable on your Anthropic account, the endpoint is rate-limited.

Security

The key is encrypted at rest with app-level AES-256-GCM before it touches the database — a random IV per encryption, tamper-checked via the GCM auth tag. The plaintext key is never logged, never returned by any endpoint (including the one you just set it on), and never appears in an audit-log payload — reads only ever return a masked form (sk-ant-… plus the last 4 characters) and metadata (set? / when / last validated). Delete it anytime from the same portal card or via DELETE /v1/tenant/llm-key — that's a hard delete of the ciphertext, not a soft flag.

Your key is never used to train Anthropic's models — Anthropic's API terms exclude API traffic from model training by default, and Goable doesn't change or override that.

Without a key

Nothing breaks. /v1/decision still returns the full physics score and the personal + archetype blend — only the LLM reasoning sentence is replaced by a deterministic template, flagged via degraded_mode: true. /v1/score/explain-counterfactual's four analytical blocks (binding constraint, marginal sensitivities, best window, best nearby spots) are pure math and run regardless — only the optional natural_language block falls back to a template. The three standalone intelligence endpoints (/explain, /briefing, /edge-case) have nothing to fall back to and return 503 INTELLIGENCE_UNAVAILABLE pointing you at PUT /v1/tenant/llm-key.

Spend guard

A per-tenant monthly token cap still applies — 500,000 tokens by default across every plan. Its purpose changed with BYOK: it used to protect Goable's shared-key bill; now it's a runaway-loop guard on your own Anthropic spend, not a plan perk. Hitting it returns 429 LLM_BUDGET_EXCEEDED until the monthly reset (1st of the month, UTC) and the affected surfaces degrade the same way they do with no key set — the physics score is never blocked by an exhausted LLM budget.