ShoutFlow's default mode runs entirely on your Mac. But sometimes you want a frontier model doing your clean-up — and that's what BYOK (bring your own key) is for.

The idea in one paragraph

Instead of the app vendor running cloud AI on your behalf — marking up the cost and inserting themselves into your data path — a BYOK app is a client. You create an API key with a model provider you already trust, paste it in once, and the app talks to that provider directly from your machine, authenticated as you. The vendor never proxies the traffic and never sees the content.

Why it's better than a bundled subscription

Cost transparency. Subscription dictation apps charge a flat monthly fee that has to cover their cloud bill for the heaviest users, plus margin. With BYOK you pay your provider's actual usage prices for exactly what you dictate. Dictation requests are small — short audio clips and a few hundred tokens of text — so for most people this is a rounding error compared to a monthly plan. ShoutFlow adds no markup and takes no cut.

Privacy shape. Your audio or text goes from your Mac to your chosen provider over TLS. One hop, one counterparty, and it's one you selected — not whichever subprocessor a vendor happens to use this quarter. You can revoke the key at any moment in your provider's dashboard.

Model choice. Providers ship better models constantly. With BYOK you point the same app at a new model name the day it ships, rather than waiting for a vendor to upgrade their backend.

How ShoutFlow implements it

Dictation in ShoutFlow is two independent stages — transcription (audio → text) and clean-up (text → writing) — and each stage picks its own engine:

Transcription: local WhisperKit by default, or your OpenAI key, xAI speech-to-text, or a compatible custom endpoint.
Clean-up: local MLX by default, or your key for OpenAI, OpenRouter, DeepSeek, Gemini, Kimi, xAI, or any OpenAI-compatible endpoint. Or off entirely, if you want the verbatim transcript.

Mix freely: local transcription with OpenRouter clean-up is a popular shape — your raw audio never leaves the Mac, and only the intermediate text goes to the model you picked.

A few implementation details that matter:

Keys live in the macOS Keychain, never in plaintext config files, never in logs, and never on our servers.
No silent fallback. If your chosen provider fails, ShoutFlow tells you rather than quietly rerouting your content somewhere you didn't approve — a fallback would change your privacy, output, and cost without asking.
Explicit data-flow disclosure. Before you enable a provider, the app shows exactly which stage will send what, where.
Connection tests and manual model entry, because provider catalogues and model aliases change faster than any hard-coded list.

Getting a key

Every supported provider issues API keys from a self-serve dashboard — typically: create an account, add a payment method, generate a key, and set a spending limit (do set one; it's good hygiene). Paste the key into ShoutFlow's provider settings, run the connection test, pick a model, done.

The bottom line

BYOK turns "trust us with your voice" into "bring the counterparty you already trust". Combined with a fully local default, it means ShoutFlow never has to choose between capability and privacy on your behalf — that stays your call, per stage, per day.

ShoutFlow is $25 once, local and BYOK modes included. No subscription — from us or anyone else — required.