You connect your own provider credentials in settings — add, test, save. A key that passes its test is set active, and the runtime uses active keys only; there is no fallback to a credential you did not provide. Which model serves which name is your call, on the models page — and so is the cost that follows from it.
The provider bills you directly at the provider’s prices. We meter every call to the cent and attribute it on the ledger. On your keys we never touch the money, which is what makes "we keep $0 of your usage" structural rather than a promise.
And if a second console is one too many — or any console is — use our keys instead, per provider, at the provider’s prices plus a disclosed 10%. The markup appears as its own line on every ledger entry, never blended into the unit price, and covers processing and operations rather than profit. Mixing is normal and expected: bring the key you already have, and let us carry the second vendor the audit role requires. If the rate ever changes, it changes prospectively, with 30 days’ notice, never retroactively.
Our keys are prepaid — we front nobody’s inference. You top up a dollar balance ($10 minimum, because the card processor’s fixed fee makes smaller deposits a bad trade for you) and managed work draws it down, each draw itemised. At zero it stands still: nothing overdraws, and the refusal names both ways forward — top up, or move the seat to your own key. And to be precise about what this is not: the balance is dollars, never a converted unit; it never expires or resets; and it refunds, on request and at cancellation. A wallet is not a credit meter. What we refuse to sell is allowances that expire and rates you cannot derive — and we still refuse.
Everything is metered, including your company’s own metabolism — planning turns, memory consolidation, heartbeats, oversight sampling. Those run whether or not work happened, they cost real cents, and they appear on your ledger under their own labels. At the default profile that runs roughly $2–6 a month — an estimate, and labelled as one, like every figure in the table below. Hiding system overhead inside the flat fee would be the one opaque line on an otherwise glass invoice.
When a key stops working, the company stands down. Runs halt, the failure lands on the ledger as a stand-down with its reason, and we email you. Nothing improvises on a dead credential and nothing bills. The failure mode is stillness.