Drıftstack docs
Docs

Your own AI provider key: required, rejected, or not allowed on this plan

You might be here because: “BYOK key required” · “add your AI provider key then try again” · “my API key for the AI was rejected” · “the provider did not accept that key” · “this plan runs AI on included credits only” · “can’t save my AI key in the desktop app” · “502 from the agent” · “AI broken” · “use my own API key for the AI” · “BYOK”

Short answer

Three different messages, three causes: the turn has no key it can run on (HTTP 502 BYOK … key required), the key you gave was rejected by the provider (same 502 with key_rejected: true), or your plan has no AI agent at all, so a key cannot enable one (403). Keys are added and tested in the web dashboard, not in the desktop app.

Check first

  • Are you adding the key in the dashboard (Settings) rather than the desktop app? The desktop app’s own sign-in credential is refused for key changes by design.
  • Does your plan allow an own key? Every plan with the AI agent does. The Trial and the legacy Personal plan have no AI agent at all, so a key does not enable one there — see ‘AI isn’t included on this account’s current plan’.
  • Is the key complete (no spaces), current, and from an account that can pay?

Likely causes and fixes

  1. “Add your AI provider key in the web dashboard, then try again.” (502, no key) — no header key, no stored key, and no fallback. Fix: dashboard → Settings → connect your provider key, then retry.

  2. Key found but rejected (502 with key_rejected: true, key_rejected_reason) — the provider refused it: invalid, revoked, an account that cannot pay or has no credit left, or an organization the provider disabled (organization_disabled). The dashboard’s Test reports whether the key was accepted, refused as invalid, or refused for an exhausted quota. The desktop app words it “…did not accept that key. Check the key, then try again.”. Fix: check the key in your provider account, add credit there if needed, paste it again and test. With organization_disabled, the provider disabled the organization the key belongs to: resolve it with the provider, or use a key from another organization.

  3. “AI isn’t included on this account’s current plan (Personal).” (403 ai_not_on_plan) — the plan has no AI agent, so saving or testing a key is refused, whether or not the account has moved to AI credits. The Trial gets the same answer, naming the Trial. The earlier Personal plan has no AI agent. Fix: move to a current plan.

  4. Key saved but credits still used first. The AI source setting decides whether your key or credits is used; a saved key is not used while the source is set to credits. The credits-exhausted message then names the step that works: send your key in the x-byok-anthropic-api-key request header, which is used whatever the source is set to (see AI credits used up).

  5. “Your … API key does not have permission for this setting.” (desktop, 401/403) — the desktop credential cannot change AI settings; use the dashboard.

If it still fails

Press Talk to a person in this chat (or open Help) and include: account email, which surface (desktop/dashboard), the exact message, the Test outcome shown, and your plan. Never send the key itself. A person checks the account’s AI source and plan; nobody at support can see or needs your key.