Bring your own keys

On self-host, you provide the API keys for voice and the brain. This page covers what to put where.

The two required keys

Key	Used for	Where
OPENAI_API_KEY	Voice (Realtime API)	.env
ANTHROPIC_API_KEY	Brain (Claude)	.env, or use a logged-in claude CLI

Choosing a brain backend

Set VB_MODEL_PROVIDER in .env to switch where the brain runs:

VB_MODEL_PROVIDER	Routes through	Also set
(blank) / anthropic	Anthropic API / your Claude subscription	—
bedrock	Amazon Bedrock	AWS creds (standard chain), VB_AWS_REGION
vertex	Google Vertex AI	GCP ADC, VB_VERTEX_REGION, VB_VERTEX_PROJECT
proxy	An Anthropic-compatible gateway (LiteLLM, internal relay)	VB_ANTHROPIC_BASE_URL, VB_ANTHROPIC_AUTH_TOKEN

For Bedrock and Vertex, also set VB_PROVIDER_MODEL and VB_PROVIDER_FAST_MODEL if the defaults don’t match.

The Settings → Brain card in the app shows the live backend (e.g. “Claude Code session · via bedrock”) so you can confirm.

Optional connector keys

If you connect Stripe, Cloudflare, Vercel, or any API-key connector, the key is stored in the vault outside the brain’s working directory. The brain sees that a connection exists; it never sees the raw token.

Where keys live

• .env — root keys (OpenAI, Anthropic, gate credentials).
• <vault>/ — encrypted store for connector keys.
• The native app — your Apple Secure Enclave for SSH keys; see Key storage.

Rotating

Edit .env, then:

docker compose restart gray
# or: systemctl restart voice-brain

For connector keys, Settings → Connections → tap the service → Edit.