No lock-in, by construction.
The customer already pays their model provider directly — BYOM isn't a feature toggle bolted onto a single-provider product, it's the foundation the whole gateway and context system is designed around.
Supported providers today
Each model a customer configures is validated against what that provider actually requires — nothing generic, nothing assumed.
Anthropic
Native API or Azure AI Foundry — requires API key.
OpenAI
Hosted API — requires API key.
Azure OpenAI
Hosted, Azure-native — requires API key.
Mistral
Hosted API — requires API key.
Google Gemini
Hosted API — requires API key.
Amazon Bedrock
For teams standardizing on AWS-hosted foundation models — requires AWS access/secret + region.
Ollama
Fully local inference — requires None — no external auth.
LM Studio
Fully local inference — requires None — no external auth.
Fully local, for the most security-conscious customers
Ollama and LM Studio deliberately require no key at all — they run entirely on the customer's own machine or network with no external authentication by convention. This is the concrete form of “your data never leaves your walls” taken to its logical end: a fully local model, talking to a fully local agent, with zero network egress required for inference at all. For deployments requiring full air-gap operation, this is what makes it possible without any external network call, model inference included.
Credentials, masked and never re-exposed
Secrets are never displayed once saved — every provider's credential is masked in the configuration UI, with only the shape needed to recognize which key is which (a trailing few characters) ever shown again. A model can be edited — endpoint, label, default settings — without ever having to re-enter or expose the secret that's already on file.
Switching providers is a config change, not a rewrite
Switching a model between providers requires no code change anywhere else in the system — the agent's tool-calling format is translated live between the OpenAI-style wire format the client always speaks and whatever the upstream provider actually needs, including full, faithful translation of tool-calling and streaming semantics between OpenAI's and Anthropic's incompatible formats.
A regulated customer needs zero network egress, even for inference
An air-gapped or heavily regulated environment can't send a single packet to an external model provider — but almost every AI coding tool assumes a hosted API is available, making it structurally unusable in that environment no matter how good its policy engine is.
Ollama and LM Studio require no key at all, and run entirely on the customer's own machine or network with no external authentication by convention — a fully local model, talking to a fully local agent, with zero network egress required for inference.
A defense contractor running Kryex fully air-gapped points the agent at a local Ollama instance instead of a hosted provider. No model call — and therefore no source code, no prompt, no completion — ever leaves the network boundary, because there's no network path for it to leave on.
Full air-gap operation is possible without waiting on a special 'air-gap edition' — it's the same product, configured to a provider that never needed the internet in the first place.
A fully self-hosted, BYOM-only deployment is a first-class, fully supported configuration, not a degraded fallback. Kryex Cloud's own hosted Model Gateway (a curated model pool) is additive for teams that want a managed, no-setup option — never mandatory.