Your AI key: how BYOK stays safe
How miatz protects your bring-your-own AI API key: AES-256-GCM encryption, a device-only mode, automatic failover and instant revocation.
- Run every AI feature on a free-tier key you control — and can revoke in seconds
- Know exactly how your key is stored: encrypted vault, or never leaving your browser at all
- Never lose a session to one flaky provider — the failover chain tries your next key automatically
Why BYOK at all
miatz's AI features — the tutor, Xook, grading assists — run on your API key, not a metered platform allowance. That keeps miatz free, keeps you in control of usage, and means you can pick a provider with a genuine free tier: NVIDIA NIM, Groq, Google AI Studio (Gemini), OpenRouter (free models), Cerebras, Together AI, Fireworks, Mistral — or any OpenAI-compatible endpoint via Custom. Most issue a key with no credit card.
How your key is stored
You choose between two modes:
- Server vault (default). Your key is sealed with AES-256-GCM and written to a secrets table that no user-facing role can read — row-level security grants access to the server process only, and the 32-byte encryption key exists solely in the server environment. A database dump alone reveals nothing. What you (and miatz staff) can see is metadata only: the provider, a label, and the key's last four characters.
- Device-only mode. The maximally private option: your key lives in your browser's local storage and is never sent to miatz servers. AI calls go directly from your browser to the provider.
Org-shared keys follow the same rules — members can see that a shared key exists, never the secret, and every call is metered into an audit trail showing which key was used, by whom, with what result.
Failover: no single point of failure
Requests run down an ordered chain: your personal keys (by your priority), then your organization's shared keys (if sharing is on, in the org's order), then the platform key where your plan includes it. If a provider times out or errors, miatz advances to the next key automatically; a key that fails authentication is flagged invalid so you know to replace it.
Revoking a key
Deleting a key in Settings → AI removes it — encrypted secret included — immediately. Device-only keys are cleared from the same page and vanish with your browser storage. For belt-and-braces, rotate or revoke the key in the provider's own dashboard too; miatz holds nothing that outlives it.
Frequently asked
Which AI providers can I use with miatz?
NVIDIA NIM, Groq, Google AI Studio (Gemini), OpenRouter (free models), Cerebras, Together AI, Fireworks and Mistral — plus any OpenAI-compatible endpoint via the Custom option. All the featured providers offer free tiers, most with no credit card.
Is it safe to give miatz my API key?
Keys are sealed with AES-256-GCM into a vault table that no user-facing role can read — database policies give access to the server process only, and the encryption key lives solely in the server environment. A database dump alone reveals nothing. Only the provider name and the key's last four characters are ever displayed.
Can I use miatz AI without my key ever leaving my browser?
Yes — device-only mode. Your key is stored in your browser's local storage and never sent to miatz servers; AI calls go directly from your browser to the provider. It's the maximally private option.
What happens if my AI provider goes down mid-session?
Miatz fails over automatically along an ordered chain: your personal keys by priority, then your organization's shared keys (if sharing is on), then the platform key where entitled. A failing key is skipped and an invalid one is flagged so you can fix it.
How do I revoke or remove my AI key?
Open Settings → AI and delete the key — it's removed immediately, encrypted secret included. Device-only keys are cleared from the same page. For complete certainty, also rotate or revoke the key in your provider's own dashboard.
Can other people in my organization see my key?
No. Org members can see that a shared org key exists (its provider and label) but never the secret itself — secrets are readable by the server process alone, and every use is metered to an audit trail.
Related guides
What free actually means at miatz: founding cohorts pay nothing, no card on file, and AI runs on your own free-tier key.
ReadHow to export a full copy of your miatz data and permanently delete your account, self-serve, from Profile → Account.
Read