--- title: Credits, billing & BYOK description: How hosted ggui prices renders against your credit balance, how to top up or redeem a coupon, and what changes when you bring your own provider key. --- Hosted ggui is prepaid. Your account carries a credit balance, generation draws it down, and you top it up when it runs low. If you would rather pay your model provider directly, you can store your own provider key instead — see [Bring your own key](#bring-your-own-key-byok) below. Everything on this page lives at `/credits` and `/keys/providers` in [the ggui console](/hosted/console/). ## Free credit New accounts get **\$5 of free credit** on first sign-in, while the launch grant lasts. It lands as a `Free credit` row in the transaction log a moment after your first visit. The grant is a launch-cohort offer, not an entitlement: it is capped per environment (a fixed number of accounts, 100 by default), and once that cap is reached no further accounts receive it. So if your balance still reads \$0.00 a minute after signing in, no row is coming — the cap is exhausted. Two ways forward, both on this page: [top up](#topping-up) on `/credits`, or store your own provider key and skip the credit path entirely ([BYOK](#bring-your-own-key-byok)). Until you do one of them, generation is refused with a `402`. ## What a render costs Only generation costs money. A `ggui_render` that has to synthesize a component is priced from the LLM call it made: input tokens and output tokens, each at that model's rate, rounded up to the nearest cent. A render that does not call an LLM costs nothing. That covers renders matched against a cached blueprint and blueprints composed in Claude Desktop — both skip generation entirely, so there is nothing to price. See the [generation pipeline](/architecture/overview/#generation-pipeline) for how matching happens before generation is ever attempted. Free credits are funded from ggui's own platform pool, which covers Anthropic (direct or routed through Bedrock), OpenAI, Google, and OpenRouter. A render routed to any provider outside that set is refused with a `402` pointing you at BYOK. ## Running out Before it calls an LLM, ggui checks your balance. Above zero proceeds; at or below zero is refused with a `402` and a fix hint rather than a silent failure. The threshold is deliberately "above zero", not "enough to cover this render". A balance of a few cents buys you exactly one more render, which drives the balance negative and records the true debt; the next check sees a non-positive balance and refuses. You never get a free loop, and you never get a render cancelled halfway for being a cent short. ## The transaction log Every movement is one row: what it was, when, the signed amount, and the balance afterwards. Four kinds appear: | Kind | What it is | | ------------- | -------------------------------------------------------- | | `Free credit` | The one-time grant on first sign-in | | `Render` | A generation charge, tagged with the session it paid for | | `Top-up` | Credit purchased through Stripe | | `Refund` | Credit returned to the wallet | ## Topping up Click **Top up** on `/credits`, pick one of the preset amounts (\$5, \$10, \$25) or type a custom one, and check out through Stripe. Custom amounts run from \$5 to \$1,000 per checkout. Credit lands when Stripe confirms the payment, which is usually a few seconds behind the redirect back to the console. The page keeps refreshing the balance for about half a minute after you return, and offers a manual refresh if the confirmation takes longer. A cancelled checkout charges nothing. ## Coupons A coupon code (`cpn_…`) is redeemed from the same page. If you belong to any orgs, the redeem form lets you choose where the credit lands — your personal wallet, or any org wallet you are a member of. See [Orgs and teams](/hosted/orgs/) for how shared wallets work. ## Bring your own key (BYOK) Store a provider API key and ggui will call that provider on your account rather than out of its own pool. Four providers are supported, each with the console dialog's get-a-key path: - **Anthropic** — Claude models. `console.anthropic.com` → Settings → API Keys. - **OpenAI** — GPT models. `platform.openai.com` → API Keys. - **Google** — Gemini models. `aistudio.google.com` → Get API key. - **OpenRouter** — multi-provider routing. `openrouter.ai` → Settings → Keys. ### How keys are stored Submit the plaintext once. It is validated against the provider, encrypted with KMS under an encryption context bound to your account and the provider, and persisted as ciphertext — it is decrypted in memory only, on the request that needs it. Afterwards the console shows the provider, your label, the last four characters, and when the key was last used. The plaintext is never readable again, by you or by ggui's own console. Remove a key at any time from the same card. ### Account-wide keys and per-app overrides `/keys/providers` holds your account-wide keys. An individual app can override them on its own **Keys** tab, and the app-level key wins for renders bound to that app — a published app can run on its own provider quota instead of drawing on yours. The two scopes are encrypted under different contexts, so an app's stored key cannot be decrypted through the account-scoped path, or the reverse. ### What BYOK changes about billing When a render actually runs on your provider key, ggui skips the credit charge entirely — your provider account pays for the model call, and charging you again would be double billing. The pre-render balance check is skipped too, so a zero balance does not block a render that your own key is funding. :::caution[A stored key alone does not redirect billing] Whether a given app's generation routes to your key is an app-level setting (`generation.keySource`), and an app that has not opted into running on its own key stays pool-funded even with a provider key on file. Flip it in the console — the **Generation billing** card on the app's **Keys** or **Settings** tab — or write it through the app-config API. If you expect BYOK to be paying and the transaction log still shows `Render` charges, this is why. ::: Resolution is per provider, so mixing is fine: for an app running on its own key, a render routed to a provider you have a key for uses that key, and anything else falls back to the credit pool.