BYO AI
Runtime Connections
Use runtime-owned subscription auth without exposing credentials to LeenOps.
Runtime-owned auth is the safer path when a tool such as Codex, Hermes, or a local bridge should keep provider credentials on its own machine.
How it works
- The external runtime connects to LeenOps.
- LeenOps stores non-secret metadata about the connection.
- Jobs are routed to that runtime.
- The runtime uses its own local provider auth.
- Results and telemetry return to LeenOps.
The platform stores runtime connection metadata in workspace_ai_runtime_connections. Runtime metadata is rejected if it contains token, key, secret, password, refresh, or auth-cache fields; runner tokens are generated separately for trusted runtime processes.
When to use it
- The customer does not want API keys stored in LeenOps.
- The provider supports subscription login in a local CLI.
- Work must run near private files or infrastructure.
- Enterprise security requires a private execution environment.