Own API keys

What it does

Own-key plans run your checks on your own OpenAI, Anthropic, Google (Gemini) and Perplexity keys, so you pay the providers directly and RulerIQ adds no markup on the AI. A free tier checks 1 brand weekly; paid own-key plans (Pro $99/mo, Agency $199/mo) check daily. The questions, models, number of runs and the Score are the same as on managed plans.

All four engines must be covered. The Score is only comparable week to week, and with other RulerIQ scores, when the same four engines answered. A brand on an own-key plan is checked only when each engine is covered by your own key. We never run a partial Score.

If you have no key for an engine, a managed add-on (we run that one engine on our key) is planned. It is not priced or on sale yet, so today you need all four keys.

Why it's safe

Only things that are true of the code today:

• Encrypted at rest. A key is encrypted with AES-256-GCM before it is stored. The encryption key is held outside the database (as a server secret), so a copy of the database alone does not contain your key.
• Write-only. After you save it, the key is never shown again. We show only its last 4 characters. To change it, replace it.
• Decrypted only to run your checks. The background worker decrypts a key to make your weekly check's requests, and nothing else. The web app handles the plain key only for the moment you save it, to test it (see below).
• Never used for anyone else. A stored key is bound to your account; it is used only for your own brands' checks.
• Never swapped for ours. If your key fails, that engine is recorded as failed for that check and we do not quietly run it on our key.
• Deleted when you remove it, or when your account is deleted. Deleting a key removes it from our storage. Deleting all your keys when a paid subscription is cancelled is built, but it is not connected to billing yet because billing is not live; when it is, cancelling will delete them.

RulerIQ holds no security certifications of its own. You can end our access at any time by revoking the key at the provider.

Set it up

For each provider, step 1 is the same: create a dedicated key just for RulerIQ, with a spending limit where the provider offers one. That way you can see exactly what RulerIQ spends and revoke it without touching anything else. What each provider documents (checked 2026-11-04):

OpenAI

1. Create a separate project just for RulerIQ and create the key inside it. A project key can be given an expiry date. (OpenAI: production best practices)
2. In that project's settings, open Limits, set a monthly Spend limit and turn on the hard limit, so requests fail once the project reaches it. Enforcement isn't instant, so spend can slightly exceed the limit. (OpenAI: spend limits)
3. Our check uses the Responses API with the web search tool on gpt-5-mini. (OpenAI: web search)

We couldn't find OpenAI documentation for restricting a key to fewer permissions, so we don't make a claim about that.

Anthropic

1. In the Claude Console, create a new workspace just for RulerIQ and create the key in that workspace.
2. On the Workspaces page, select it and click Spend limits to cap monthly spend. You can also set rate limits for the workspace under Rate limits. The Default Workspace can't have a spend limit, so use a new workspace. (Claude: workspaces)
3. Web search must be enabled for your organization (an admin can turn it off in the Console). If it is off, saving the key fails with a message saying so. Our check uses claude-haiku-5-5 with web search. (Claude: web search tool)

Google (Gemini)

1. In Google AI Studio, open API Keys, create a new key for RulerIQ, and use Add restrictions, then Restrict to Gemini API only. (Google: Gemini API keys)
2. Google's key documentation we checked does not describe a hard spend cap; it points to billing alerts in the Google Cloud console. Set a budget alert there. We can't promise a cap for Google.
3. Our check uses gemini-3.6-flash with Grounding with Google Search. Gemini 3 and newer models include 5,000 free search requests a month shared across those models, then $14 per 1,000. (Google: grounding with Google Search)

Perplexity

1. In the Perplexity API console, create a separate key for RulerIQ (keys live inside a project and you can have several) and name it so you can find it later. (Perplexity: API key management)
2. Perplexity's key documentation we checked does not describe per-key spend limits or per-key permissions, so we can't promise either. Check billing settings in the console, and revoke the key if anything looks wrong.
3. Our check uses the Agent API with the web search tool on perplexity/sonar. (Perplexity: Agent API)

Then paste each key in Settings, Keys and connections, and click Check and save.

Test it

Saving is the test. When you click Check and save, RulerIQ makes one small request with that exact model and web search tool, so a key that is valid but lacks web search (or the model) fails right there with a message for that provider. The request costs a cent or two on your account. The key is saved only if it works.

What it costs on your account

Settings shows an estimate per provider before you save, for the brands you track. It comes from our cost model (about 75 calls per engine per check at current rates, up to about 99 when answers disagree and we ask again), so it is an estimate, not your provider invoice. For one brand checked weekly (the free tier), at current rates:

Paid own-key plans (Pro and Agency) check daily, so their provider cost is roughly 7× the weekly figure above per brand.

Each check also has a per-engine cost cap so one run can't run away on your bill. After each check, Settings shows each key's last use, checks run this month, the estimated spend this month on that key, and the last check's cost.

When a key fails

If a key is rejected, out of credit or quota, over a spend limit, or lacks web search or the model, then for that check:

• that engine is recorded as failed, and the check is marked as not complete;
• the key is marked Needs attention in Settings;
• we email you (when we have your address);
• weekly checks pause until you replace the key. We never run that engine on our key instead.

A short rate limit or provider outage only fails that engine for that check; it does not mark your key broken.

What RulerIQ can and can't access

A key lets us make requests to that provider as you, and you are billed for them. We use it to ask the buyer questions for your own brands, not for anything else.

Disconnect and delete

Revoke it any time in the provider's console (that ends our access immediately) and in Settings with Remove, which deletes our stored copy. Removing a key pauses your weekly checks until all four engines are covered again. For one-off checks on the site, a key you send with the request is used for that request only and is not saved.