OKY relies on a handful of outside services — link and domain reputation, AI analysis, crypto-address risk, Android app reputation. By default every scan runs on OKY's shared keys. An organization can bring its own key for any of those services under Organization → Integrations; from then on every scan run by one of your members uses your key for that service.
Why you might want this
- Your own quota. Busy organizations stop sharing a daily limit with everyone else on OKY.
- Your own contract. If you already pay a vendor (VirusTotal Enterprise, an OpenAI or Anthropic account), scans run under that agreement and its data-handling terms.
- Your own visibility. Usage shows up on the vendor's dashboard under your account, not OKY's.
Services you can bring a key for
| Group | Service | Used for | Where to get a key |
|---|---|---|---|
| Link & domain reputation | VirusTotal | Checking links, files and domains against known threats. | virustotal.com |
| APIVoid | Extra reputation checks for links, domains and IP addresses. | apivoid.com | |
| Google Web Risk | Google's threat list for links your people open. | cloud.google.com | |
| AI analysis | Anthropic Claude, OpenAI, Google Gemini, xAI Grok, Perplexity, Mistral | AI-assisted analysis of messages and pages. Bring a key only for the providers you use; OKY picks among the ones that are configured. | Each provider's developer console — linked from the Integrations page. |
| Crypto risk | Match Systems | Risk scoring for crypto addresses and transactions. | matchsystems.com |
| App scanning | Koodous | Reputation lookups for Android apps. | koodous.com |
Sign-in (SSO), mail and other infrastructure credentials are not part of this — they are configured under Sign-in & domains or by OKY.
The set of services open for customer keys is managed by OKY and can change; your Integrations page always shows the current list. If OKY closes a service you brought a key for, the key stays stored but inactive (marked "inactive — managed by OKY") until the service reopens or you remove it.
Who can manage keys
Owners and admins — the same people who manage sign-in and policies. Employees never see the page. Every add, test and removal is written to the organization's audit log with the service name (never the key itself).
Adding, testing, rotating, removing
- Add
Organization → Integrations → Add key next to the service. Paste the key and choose Test & save. OKY asks the vendor whether it accepts the key before storing it; a rejected key is not saved. If the vendor cannot be reached at that moment you can Save without testing and test later.
- Test
The Test button re-checks a stored key with the vendor at any time. The result (verified / rejected) is shown next to the key.
- Rotate
Rotate replaces the stored key with a new one — same flow as adding. The old value is gone the moment the new one is saved; scans in flight finish, the next ones use the new key.
- Remove
Remove deletes your key; scans for your members go back to OKY's shared key for that service.
If a key stops working
When a vendor refuses your key during a scan (revoked, expired, out of credit), OKY marks the service as key rejected on the Integrations page and your members' scans simply continue without that service until you rotate the key. OKY deliberately does not fall back to its own key: you would never learn the key is broken, and the vendor bill would silently move to OKY. Rotate the key to restore the service.
How keys are stored
- Encrypted at rest with the same vault that protects OKY's own platform keys; the encryption key never sits in the database.
- Write-only: after saving, OKY shows only the last four characters. Nobody — not your admins, not OKY staff — can read a stored key back.
- Scoped to your organization. A key is used only for scans run by your members; no other tenant can reach it.
- Audited: add, test, rotate and remove land in your audit log; removals by OKY staff are additionally audited on OKY's side.
Billing note
Usage on your own keys is billed by the vendor to your account, under your plan and quotas. OKY's subscription does not change.