Last reviewed against v0.9.0
BYO key
Where keys are stored, how to rotate, why this is the model.
ShellYard supports bring-your-own keys on every tier.
Where keys live
- Free — OS keychain (Keychain on macOS, Credential Manager on Windows, libsecret on Linux). Never leaves the device.
- Pro and above — cloud KMS-wrapped vault, keyed by provider. Synced via the same path as connection vault credentials.
Rotating
Settings → AI → <provider> — overwrite the key value. The next request uses the new key.
OpenAI-compatible
The OpenAI-compatible provider takes both an API key and a Base URL, so you can point at any OpenAI-API-compatible endpoint without changing keys.