Zero-Markup AI Architecture

Bring Your Own Key (BYOK) AI Architecture

Stop paying 50x markups on proprietary sales software credits. Connect your own direct API keys for DeepSeek, OpenAI, Anthropic, Groq, and Google Gemini. Encrypted with AES-256-GCM and billed directly at raw provider token rates.

Start Sending Free Inspect Security Architecture
AES-256-GCM Cipher

Authenticated encryption at rest

Zero Token Markup

Pay wholesale LLM API prices

5 Major Providers

DeepSeek, OpenAI, Anthropic, Groq, Gemini

Ephemeral Memory

Keys never exposed to client browsers

Interactive Console

Experience Direct LLM Key Management

Bottom Line Up Front (BLUF):

InvokeIQ BYOK lets sales teams plug direct API credentials from 5 major AI providers into their cold email workspace. All credentials are encrypted with AES-256-GCM, masked permanently on the client, and verified via roundtrip diagnostic pings. This eliminates proprietary credit systems and reduces lead personalization costs by over 95%.

Toggle between providers below, test roundtrip latency handshakes, and inspect real-time token cost modeling per 1,000 prospects.

AES-256-GCM Provider Console

Interactive BYOK Key Manager & Diagnostic Ping

Simulate connecting direct API keys, testing roundtrip latency, and inspecting encryption safeguards.

Zero Token Markup
DeepSeek CredentialsActive

Ultra-low token pricing for high-volume CSV icebreakers and bulk company enrichment.

Keys are permanently masked on the client and decrypted only in ephemeral memory.
deepseek-chat (V3)Default
Can be overridden per campaign or column formula.
Handshake Latency
380 ms
Direct API roundtrip speed
Cost Per 1,000 Leads
$0.15
Assumes 750 tokens per contact
Legacy SaaS Equivalent
$80.00
At typical $0.08 per credit markup
Security & Architecture

How InvokeIQ Protects and Routes Your AI Keys

Direct Architecture Overview:

Enterprise key management requires authenticated encryption, zero client exposure, and intelligent provider routing. InvokeIQ decouples email campaign generation from credit monetization by integrating directly with provider endpoints via secured backend workers.

Traditional outreach software traps sales teams inside proprietary credit tiers. Here is how InvokeIQ delivers enterprise-grade security with wholesale pricing flexibility.

01

AES-256-GCM Authenticated Encryption

Keys are encrypted at rest using Galois/Counter Mode (GCM). Each stored credential contains a 12-byte initialization vector, a 16-byte authentication tag, and ciphertext. Any tampering with data automatically invalidates decryption.

NIST SP 800-38D standard compliance
02

Zero Client-Side Exposure

The InvokeIQ backend permanently masks saved keys as •••••••••••••••••• before returning responses to the browser. Your secret API tokens are decrypted strictly in ephemeral memory on secured backend workers.

Masked payload responses across all endpoints
03

Zero Platform Token Markup

You pay exactly what AI providers charge. Enriching 1,000 leads with DeepSeek V3 costs approximately $0.15 in direct tokens. InvokeIQ charges zero percentage fees, zero per-run surcharges, and zero transaction cuts.

Direct provider billing with 0% margin
04

Live Diagnostic Handshake Pings

The built-in connection tester executes real-time diagnostic handshakes against provider endpoints. It measures network latency in milliseconds and verifies model invocation scopes before batch campaigns execute.

Sub-second roundtrip latency testing
05

Granular Model Routing

Define a global default model at the workspace level while maintaining the flexibility to override models for specific tasks. Use Groq for ultra-fast CSV cleaning and Anthropic Claude for executive value propositions.

Per-campaign and per-column model selection
06

Automatic Rate-Limit Backoff

When enriching 50,000 prospects, external APIs may return HTTP 429 rate throttles. InvokeIQ job queues automatically throttle request concurrency, calculate token usage, and apply exponential backoff to ensure smooth completion.

Token-aware batch queue management
Cryptographic Specification

AES-256-GCM Authenticated Encryption Pipeline

Bottom Line Up Front (BLUF):

Legacy AES-CBC encryption is vulnerable to bit-flipping and padding oracle attacks. InvokeIQ implements AES-256-GCM (Galois/Counter Mode), an authenticated symmetric cipher that produces a cryptographic authentication tag. If even a single byte of stored ciphertext is altered, decryption fails immediately, preventing corrupted credentials from leaking.

Here is the cryptographic specification executed on the InvokeIQ backend whenever credentials are saved or decrypted.

Node.js Crypto Authenticated Encryption Engineserver/utils/encryption.ts
// Cipher configuration: AES-256-GCM with 12-byte initialization vector
const ALGORITHM_GCM = 'aes-256-gcm';
const getKey = () => crypto.createHash('sha256').update(process.env.ENCRYPTION_KEY).digest('base64').substring(0, 32);

// Encrypt: Generate unique IV, encrypt text, compute 16-byte auth tag
export function encrypt(text: string): string {
  const iv = crypto.randomBytes(12); // 12-byte IV for optimal GCM security
  const cipher = crypto.createCipheriv(ALGORITHM_GCM, Buffer.from(getKey()), iv);
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  const authTag = cipher.getAuthTag().toString('hex');
  return `$${iv.toString('hex')}:${authTag}:${encrypted}`;
}
1. 12-Byte Unique IV

A cryptographically random 12-byte initialization vector is generated for every single credential encryption. No two keys share identical ciphertext even if the underlying key is identical.

2. 16-Byte Auth Tag

The Galois Message Authentication Code (GMAC) authenticates both ciphertext and payload headers. Any database manipulation triggers an instant auth error rather than corrupt output.

3. Strict Key Masking

API routes explicitly overwrite encrypted fields with •••••••••••••••••• prior to JSON transmission. Raw keys are never serialized in API responses or logs.

Provider Benchmarks

Supported AI Models & Token Economics

Bottom Line Up Front (BLUF):

Model selection directly dictates outbound ROI. DeepSeek V3 provides the lowest token price ($0.14 / 1M input), Groq provides the highest throughput (500+ tokens/second), and Anthropic Claude 3.5 Haiku delivers the highest linguistic nuance for enterprise sales pitches.

The table below compares official direct provider pricing and recommended use cases across all 5 supported platforms.

AI ProviderFlagship ModelInput / 1M TokensOutput / 1M TokensInference LatencyOptimal Outbound Use Case
DeepSeekDeepSeek V3$0.14$0.28350 - 450 msHigh-volume CSV enrichment & icebreaker generation.
OpenAIGPT-4o-mini$0.15$0.60220 - 300 msReliable enterprise compliance and structured JSON parsing.
GroqLlama 3.3 70B$0.59$0.79< 90 ms (500+ tok/s)Real-time batch processing & large contact lists.
AnthropicClaude 3.5 Haiku$0.80$4.00280 - 360 msNuanced enterprise copywriting & negative constraints.
Google GeminiGemini 1.5 Flash$0.075$0.30180 - 250 msLarge context analysis (PDFs, whitepapers, landing pages).
Scale Economics

Enrichment Cost at Scale: BYOK vs. Credit Platforms

Bottom Line Up Front (BLUF):

Legacy sales platforms monetize outbound campaigns through proprietary credits ($0.05 to $0.15 per lead). Personalizing 25,000 leads on Clay or Apollo costs between $1,250 and $3,750. In InvokeIQ, using your own DeepSeek or GPT-4o-mini key costs under $5.00 total.

Here is the actual cost breakdown based on 750 tokens of website context and generated copy per prospect.

Prospect ContactsInvokeIQ BYOK (DeepSeek)InvokeIQ BYOK (GPT-4o-mini)Clay (Avg $0.08/credit)Apollo / Instantly AI Add-On
1,000 leads$0.15$0.22$80.00$50.00 - $97.00
5,000 leads$0.75$1.12$400.00$250.00+
25,000 leads$3.75$5.62$2,000.00$1,250.00+
100,000 leads$15.00$22.50$8,000.00Custom Enterprise Tier
Edge Case Handling

Provider Error Codes & Circuit Breakers

Bottom Line Up Front (BLUF):

Direct API connections require defensive exception handling. When provider outages, token rate limits, or account balance depletion occur, InvokeIQ background workers automatically pause the queue, execute exponential retries, and protect active campaign dispatches.

Error SignalRoot CauseInvokeIQ Automated ResponseUser Action Required
HTTP 401 UnauthorizedInvalid, expired, or deleted API key token.Job queue paused immediately.Update secret key in Settings > AI Providers and run test ping.
HTTP 429 Rate LimitTokens Per Minute (TPM) or Requests (RPM) exceeded.Exponential jitter backoff (30s, 60s, 120s).None (automatic recovery) or upgrade provider tier limits.
HTTP 402 Insufficient BalanceProvider billing credits depleted or card declined.Queue held safely; zero data lost.Add funds in OpenAI/Anthropic console; click resume in InvokeIQ.
HTTP 503 Provider OverloadUpstream model outage or GPU capacity constraint.Automatic fallback to secondary model.Optional: configure backup provider (e.g., DeepSeek to Groq).
GCM Decryption MismatchDatabase tampering or missing ENCRYPTION_KEY salt.Decryption returns empty; auth fails safely.Re-enter API key in settings console to re-encrypt with current salt.
Configuration Runbook

Step-by-Step BYOK Setup Protocol

Bottom Line Up Front (BLUF):

Connecting your AI provider keys requires 5 steps: generating a secret token from your AI console, pasting it into InvokeIQ settings, executing an authenticated ping handshake, selecting a default routing model, and deploying the key to live campaign sequences.

01

Step 1: Generate API Token from AI Provider Console

Log in to your chosen provider dashboard (OpenAI Platform, Anthropic Console, Groq Cloud, DeepSeek Platform, or Google AI Studio). Navigate to API Keys and create a new secret key with model invocation permissions.

02

Step 2: Access Settings > AI Providers in InvokeIQ

In your InvokeIQ dashboard, open Settings and click the "AI Providers" tab. You will see configuration cards for Google Gemini, OpenAI, Anthropic, Groq, and DeepSeek.

03

Step 3: Paste Key and Apply AES-256-GCM Encryption

Paste your secret key into the provider input field. InvokeIQ immediately encrypts the credential with AES-256-GCM using a cryptographically unique 12-byte initialization vector before storing it in the database.

04

Step 4: Execute Test Connection Handshake

Click "Test Connection". The server executes a lightweight test call against the provider API, verifies key validity, measures latency in milliseconds, and confirms active status.

05

Step 5: Set Default Routing and Deploy to Outreach Sequences

Select your preferred default model (e.g., DeepSeek V3 or GPT-4o-mini). The key is now globally available across all AI column builders and multistep email sequence generators with zero credit deduction.

Knowledge Base & Technical Queries

Frequently Asked Questions About BYOK Architecture

Section Summary (BLUF):

BYOK architecture enables direct API connectivity to AI providers, decoupling campaign scale from software credit markups. Below are definitive answers regarding encryption security, cost savings, rate limits, and model routing.

What is Bring Your Own Key (BYOK) in cold email software?

Bring Your Own Key (BYOK) is an enterprise software architecture that allows you to connect your own direct API accounts for artificial intelligence providers (such as DeepSeek, OpenAI, Anthropic, Groq, or Google Gemini) instead of buying proprietary software credits from the platform. You pay the raw wholesale token rates directly to the AI provider, eliminating 10x to 50x platform credit markups.

How does InvokeIQ secure my private API keys?

All API keys in InvokeIQ are encrypted at rest using AES-256-GCM (Galois/Counter Mode), an authenticated cryptographic standard. Each key is encrypted with a random 12-byte initialization vector and a 16-byte authentication tag. Raw keys are never transmitted to browser clients, are permanently masked as dots in the user interface, and are decrypted only in ephemeral server memory during active batch execution.

How much can I save using BYOK compared to credit-based sales tools?

Traditional sales platforms like Clay or Apollo charge between $0.05 and $0.15 per enrichment credit. In contrast, running 1,000 lead enrichments via InvokeIQ BYOK using DeepSeek V3 or OpenAI GPT-4o-mini costs approximately $0.15 to $0.25 total in direct API tokens. That represents a 95% to 98% operational cost reduction.

Which AI models and providers are supported in InvokeIQ?

InvokeIQ supports 5 major AI provider platforms: DeepSeek (DeepSeek V3, DeepSeek R1), OpenAI (GPT-4o, GPT-4o-mini), Anthropic (Claude 3.5 Sonnet, Claude 3.5 Haiku), Groq (Llama 3.3 70B, Llama 3.1 8B), and Google Gemini (Gemini 1.5 Flash, Gemini 1.5 Pro).

What happens if my API key hits a rate limit or runs out of credits?

If a provider returns an HTTP 429 Rate Limit error, InvokeIQ background job workers apply exponential backoff jitter with automatic queue retries. If the key balance is exhausted or authentication fails with HTTP 401, the campaign execution pauses safely and alerts you without dropping queued prospects.

Can I configure different models for different outreach tasks?

Yes. InvokeIQ allows you to set a default model at the workspace level, but you can override the model on individual AI columns or campaign prompts. For instance, you can use Groq Llama 3.3 70B for ultra-fast company name cleaning and Anthropic Claude 3.5 Haiku for nuanced executive value propositions.

Does InvokeIQ charge any transaction fees on BYOK token usage?

No. InvokeIQ charges zero transaction fees, zero token margins, and zero per-run surcharge. All token usage is billed directly by your AI provider on your own corporate billing account.

Why is Groq recommended for high-volume cold email campaigns?

Groq uses Language Processing Unit (LPU) hardware to deliver inference speeds exceeding 500 tokens per second. When enriching large CSV files of 10,000 prospects, Groq completes batch jobs in minutes rather than hours, reducing job processing latency by up to 8x compared to standard cloud GPUs.

How does the 'Test Connection' diagnostic handshake work?

When you click 'Test Connection', InvokeIQ sends a lightweight authenticated ping request to the provider endpoint. It verifies that the credential has valid model invocation scopes, measures roundtrip server latency in milliseconds, and returns a verified status badge.

Is BYOK available on all InvokeIQ plans?

BYOK is available on InvokeIQ Pro ($19/month flat) and Growth plans. Free plan users can use included platform credits or upgrade to Pro to unlock unlimited BYOK scaling across all supported providers.

Ready to scale?

Your next 1,000 emails don't have to soundidentical.

Turn lead data into personalized outreach and launch your first campaign without stitching together multiple tools.

No credit card required. Cancel anytime.