API Keys

Why BYOK

Ironwork uses your Anthropic API key directly. There is no markup, no middleman, and no hidden costs. All Claude usage flows through your Anthropic account, giving you full cost visibility and control over rate limits, model access, and spending caps.

This means you pay Anthropic directly for the tokens your agents consume. Ironwork itself adds no AI processing fees.

Setup

1. Navigate to Settings in your workspace dashboard.
2. Click Add API Key.
3. Paste your Anthropic API key. It starts with sk-ant-api...
4. Ironwork validates the key before saving. If the key is invalid, it will be rejected with an error message.

Validation

When you add or update an API key, Ironwork validates it by making a lightweight request to the Anthropic API. Invalid keys, expired keys, and keys with insufficient permissions are rejected immediately. You will see a clear error message if validation fails.

Encryption

API keys are encrypted at rest with AES-256-GCM. The encryption key is separate from the database credentials and is configured as an environment variable on the Ironwork server. Your API key is:

• Never logged to any log file or monitoring system
• Never exposed in API responses (only a masked preview is shown)
• Decrypted only at the moment an agent needs to make a Claude API call
• Never sent to any third party other than Anthropic

Cost management

All Claude usage appears on your Anthropic dashboard under your account. Ironwork adds no extra cost — you pay exactly what Anthropic charges for the tokens consumed.

To manage costs, use Anthropic's built-in spending limits, rate limits, and usage monitoring. Each agent task results in one or more Claude API calls, and the token usage depends on the size of the context (issue description, codebase files, MR diffs, etc.).

Key rotation

To rotate your API key, delete the existing key from your workspace settings and add the new one. Agents automatically use the latest key for all subsequent tasks. There is no downtime — the switch is immediate.