Bring your own Anthropic key

When you bring your own key, the LLM-powered surfaces run on YOUR Anthropic key, and Anthropic bills you directly. A Goable-provided key is available only as a fallback path; when you set your own, Goable does not use a shared key for your tenant's LLM calls.

The model

Goable's core is deterministic physics; the scoring path does not call an LLM. A handful of surfaces layer natural-language explanation or reasoning on TOP of a score that's already been computed: narrating why a verdict came out the way it did, briefing a multi-slot day, or producing a personalized go/no-go sentence. Those surfaces call Anthropic's API. Instead of Goable operating one shared key and absorbing the bill across tenants, each tenant can set their own key once, and that tenant's LLM calls then run against it, so Anthropic invoices you, not us.

Which features need a key

The rest of the API, /v1/score and its variants, /v1/recommend-spot, historical, portfolio, projections, underwriting and observations, works with zero Anthropic configuration. Only these five surfaces touch an LLM, and only the LLM part of each is affected by a missing key:

Get an Anthropic key

Create an account at console.anthropic.com, add billing, and generate an API key (starts with sk-ant-). That's an Anthropic account and an Anthropic bill; Goable does not see your payment details and does not mark it up.

Load it into Goable

Set it from the tenant portal at console.goable.io/portal/settings: paste the key into the AI / LLM key card and save. Programmatically, the same three calls back the portal card:

PUT /v1/tenant/llm-key
{ "apiKey": "sk-ant-…" }

// returns 204 on success, 422 LLM_KEY_INVALID if Anthropic rejects it

GET /v1/tenant/llm-key
// returns { set: true, last4: "wxyz", setAt, lastValidatedAt }

DELETE /v1/tenant/llm-key
// returns 204, hard-deletes the stored key

PUT makes one cheap, real Anthropic call before storing anything, so an invalid or access-less key is rejected immediately (422 LLM_KEY_INVALID) rather than failing silently on the next real request. Because that validation call is billable on your Anthropic account, the endpoint is rate-limited.

Security

The key is encrypted at rest with app-level AES-256-GCM before it touches the database: a random IV per encryption, tamper-checked via the GCM auth tag. The plaintext key is never logged, never returned by any endpoint (including the one you just set it on), and never appears in an audit-log payload; reads return only a masked form (sk-ant-… plus the last 4 characters) and metadata (set? / when / last validated). Delete it anytime from the same portal card or via DELETE /v1/tenant/llm-key; that's a hard delete of the ciphertext, not a soft flag.

Your key is not used to train Anthropic's models: Anthropic's API terms exclude API traffic from model training by default, and Goable doesn't change or override that.

On privacy: the LLM surfaces sit on top of scores and, for personalization, on a tenant-generated pseudonymous reference. A pseudonymous reference can still be personal data under GDPR Recital 26, and Goable acts as a processor for it. Customers must not submit direct identifiers or special-category data to these surfaces. See security and the privacy policy.

Without a key

Nothing breaks. /v1/decision still returns the full physics score and the personal and archetype blend; only the LLM reasoning sentence is replaced by a deterministic template, flagged via degraded_mode: true. /v1/score/explain-counterfactual's four analytical blocks (binding constraint, marginal sensitivities, best window, best nearby spots) are pure math and run regardless; only the optional natural_language block falls back to a template. The three standalone intelligence endpoints (/explain, /briefing, /edge-case) have nothing to fall back to and return 503 INTELLIGENCE_UNAVAILABLE pointing you at PUT /v1/tenant/llm-key.

Spend guard

A per-tenant monthly token cap still applies: 500,000 tokens by default across all plans. Its purpose changed with BYOK: it used to protect Goable's shared-key bill; now it's a runaway-loop guard on your own Anthropic spend, not a plan perk. Hitting it returns 429 LLM_BUDGET_EXCEEDED until the monthly reset (1st of the month, UTC) and the affected surfaces degrade the same way they do with no key set; the physics score is not blocked by an exhausted LLM budget.