Choosing Which Third-Party System Gets a Read-Only Key vs. a Provider Key
AI Keys and Connectors look similar in Settings and are easy to mix up — here's what each one is actually for, and how to tell which page a given credential belongs on.
Once a workspace has both AI Keys and Connectors set up, it's a fair question which one a new credential belongs on. They look similar — both are a list of providers or systems, a place to paste a key, and a "we never show it back to you" promise. But they exist for different jobs.
AI Keys: who generates the model's output
AI Keys (BYOK) is for AI model providers — OpenAI, Anthropic, Google AI, and the rest. Adding a key here changes which account actually runs your AI requests: instead of using the platform's shared pool at platform pricing, your requests run on your own provider account, and the platform charges a smaller percentage fee instead. This page is about who computes — which model, running under whose billing relationship, produces the text or output your agent generates.
Connectors: what your agent is allowed to read
Connectors is for third-party systems your agent needs to pull information from — a CRM, a support desk, whatever's on the reviewed catalogue. Adding a key here doesn't change how your agent thinks or what model it runs on; it changes what real-world data the agent can look up while it works. This page is about what gets read — a fixed, reviewed set of read-only endpoints on systems you already use, accessed with a key that's scoped to your account there.
Why the two pages share a design
Both pages were built to the same three rules deliberately: neither ever shows a stored key back to you, neither invents an entry the backend doesn't actually serve, and neither offers a form the deployment can't honor if encryption isn't configured. That's not a coincidence — the Connectors page's own documentation says explicitly that its rules were copied from the AI Keys page. If you understand one, you largely understand the other's guarantees too.
A quick way to decide which page you need
Ask what the credential is for. If it's a key from an AI model provider and the goal is changing which account pays for model usage, that's AI Keys. If it's a key from a system like a CRM or support tool and the goal is letting your agent look something up there, that's Connectors. And if what you actually want is "let my agent call any API I point it at" — that's neither, and deliberately so; see the companion piece on why an open-ended connector isn't on the roadmap.