You enter your own keys and accounts on your own workspace and pay the provider yourself; Denkploeg only charges the subscription. You find the keys under Connections, AI models of your workspace and accounts such as OpenArt and Higgsfield under Connections. An agency can let its own key or account work for clients, but only if it chooses to.
Which key applies
For each provider you see one of three states:
- Own key (for an account: Own account): you pay the provider directly for what you use;
- Via the agency: the agency shares its key or account with your workspace and pays for the usage itself. A key or account of your own always takes precedence;
- Not set up yet: the studio says "Add your own key under Keys", with a link, and nothing goes on the agency's or Denkploeg's bill.
An agency shares nothing until it chooses to. The agency's key therefore never falls through to its clients by itself. Only the agency's own workspace always works on the agency's key.
Every result shows which key it was made with, so you know whose bill it was.
Adding a key or account of your own
- Open Connections > AI models in your workspace for an account such as OpenArt or Higgsfield.
- Choose Add your own key (or Connect your own account) and paste the key or sign in with the provider.
- Use Test to see whether a key works. An account of another workspace, even under the same agency, is never visible or usable in yours.
If you only have Via the agency, there is nothing you need to do. You can always add a key or account of your own to be independent.
Replacing or removing a key that is set
A key or connection that is already set is locked. You see that it is there, with only its last four characters (or the account name for an authorization) and when and by whom it was set. Choose Replace to open the field, paste the new key and give the six digits from your app. Without that code nothing changes and the old key keeps working. The same applies to removing and disconnecting, to connecting again through an authorization (Google, Meta, Shopify, WooCommerce and MCP services) and to the Claude or Codex subscription login of an agency. If you already gave a code in the last five minutes for this workspace (or this agency), you do not need to enter one again; a code for another workspace or agency, or a code from signing in or signing, does not count here. The last four characters (only for long keys) and who set the key are visible only with the right to manage keys. Cancel closes the field again. Setting a key for the first time does not need a code, and neither does Test. If your account has no second step yet, turn it on under Two steps.
Which providers
Claude (Anthropic) and OpenAI for text and images, and for Brand Studio the image editors Recraft, Photoroom, fal, Vectorizer.AI and Ideogram. If a provider needs a key you have not entered, the related action is greyed out with the reason.
How safe
A key is stored encrypted, separately per workspace or agency, and never shown again: you only see that it is set and its last characters. You can always replace or remove it. For each provider it says whether it may train on your input; until that is known, Denkploeg does not use it for client work.
Keeping costs in check
For paid work you see the estimate first, and a ceiling applies per day and per month. If an action exceeds that ceiling, it waits for your approval. Next to a button that costs money the amount is shown with an explanation: how much, to whom, with which key and why. Everything that was spent is listed per provider and per key under Usage and costs.
If a stored key can no longer be read, the connection asks you to enter it again. The old value is never shown. Replace it using the same form; this also applies to agency keys and subscription logins.
Does your Claude subscription no longer work? The director says so in the conversation: Your Claude subscription no longer works: link it again under Connections of your agency. Nothing was carried out. If the agency has its own API key, or the workspace has credits, the same question continues there automatically with a notice; otherwise you only see this message. Link the subscription again under Connections, tab AI.
Does a connection say "Log in again"? Then the provider no longer accepts the login: the refresh key was revoked or has expired, or the service gave none. The crew gets an error when it uses the connection. Choose Log in again on the card under Connections and sign in at the provider; the connection then works again. A temporary outage at the provider does not count as a revocation.