The API key was always the weird part

For a consumer app, the API key was always an awkward thing to demand. Put a language model behind a button and the developer has, without quite meaning to, taken on a small billing operation: provision the key, meter the tokens, absorb or mark up the cost, and answer for the behavior of a model they didn’t build. The key is the trivial part. The real weight is everything it requires — becoming a payment processor, carrying liability for how a model behaves, watching a bill climb in step with your own success.

Until now the choices were all bad. Eat the model costs and watch them scale past whatever the app earns. Mark them up and hope users tolerate paying for tokens on top of a subscription they already have. Or make each user paste in their own API key and lose most of them at the setup screen. Every path puts the developer in the middle of the bill.

That arrangement is starting to fall apart, and for once in a way that helps. Anthropic shipped subscription auth in its agent SDK this year: an app can authenticate against a user’s existing Claude Pro or Max plan rather than a developer key. The user already pays for the intelligence. The app borrows it, with permission — no developer key, no token bill. Tom Parandyk calls the pattern bring-your-own-agent: you bring the agent, it does the work, and the developer’s metered account never enters the picture.

If it sounds familiar, that’s because the web solved a version of this already. For years every app held your password. Then delegated auth arrived, the app stopped holding the secret, and you just brought your own account and clicked allow. Bring-your-own-agent is that same move applied to intelligence. You bring the model; the app stops holding the meter.

What actually changes is who holds the meter, and that decides what a small app has to be. An app that doesn’t meter tokens doesn’t need to be a payment company. It makes no implicit promise about output quality, because the user chose the agent, not the developer. You ship the thing and charge nothing for the intelligence; the user’s own subscription covers the work. The floor for building something useful drops to roughly anyone with an idea, and the gains from that land in the long tail of new builders far more than at the labs themselves.

The catch is real. This lasts exactly as long as the labs allow it. Anthropic shipped it; nothing obliges them to keep it, and if letting consumer plans power third-party apps starts denting API revenue, the restrictions will write themselves — bring-your-own-agent folds straight back into bring-your-own-key, developer holding the meter again. There’s a second fragility beneath that one. The pattern only feels unified while the labs stay compatible; the day each ships its own auth flow and its own command shape, “works with whatever agent you have” stops being true and you are building against a single vendor after all. It is elegant and contingent at the same time. Build on it the way you’d build on anything a platform hands you and can take back: with a fallback in mind, and without staking the whole product on it.

I don’t think the key disappears. It stops being the default front door for consumer AI. “Bring your own subscription” takes its place for an unglamorous reason: the alternative asks a solo developer to be a billing company and a quality guarantor for a model they didn’t choose, and almost nobody wants that job. The key made sense while the app was the one buying the compute. Once the user brings their own, it’s a leftover from an arrangement we’re already leaving behind.