Bring your own model provider keys and a truer tokens-under-management view

Projects can now run AI surfaces on their own model provider keys: set a project default key in settings, override individual surfaces like assistants, the risk-policy judge, or the prompt-injection classifier, and see at a glance which surfaces run on your key versus the platform key. Billing also gets more honest — tokens under management now counts only the agent traffic the platform observes from your users' sessions, never inference the platform spends itself, with richer breakdowns by model, agent, provider, project, user, and role.

Features

• Bring your own model provider keys #4115 - Manage model provider keys from project settings: set a project default OpenRouter key, override individual surfaces, and see which surfaces run on your key versus the platform key. Keys are validated with the provider on save, stored encrypted, and never returned by the API. (Author: @danielkov)
• Assistants run on your key #4114 - Assistant completions route through a project's own model provider key when one covers the assistants slot, with the platform-covered behavior unchanged for projects without a key. (Author: @danielkov)
• Your key for risk scanning too #4116 - The risk-policy judge and the prompt-injection classifier each get an independent key slot, falling back to the project default key and then the platform key when unset, and both slots are listed in project settings #4117. (Author: @danielkov)
• Tokens under management, redefined as observed agent traffic #4146 - The billing page now counts the tokens the platform observes coming from users' agent sessions (input, output, and cache writes), never inference the platform spends itself. Breakdowns now cover model, agent, provider, account type, project, user, division, department, and role. (Author: @daviddanialy)
• Average token throughput at a glance #4168 - The billing cycle panel gains an average tokens-under-management stat with a per hour, day, or week toggle, computed over the elapsed window of the active cycle. (Author: @daviddanialy)
• Manage headers on remote MCP servers #4076 - A new API manages the headers a remote MCP server sends upstream, so servers that need custom header configuration can be wired up without workarounds. (Author: @svadrutk)
• See who uses a Shadow MCP server #3947 - A project-scoped API lists the users and usage of a Shadow MCP server, with generated dashboard SDK support, so unsanctioned MCP usage can be traced back to the people using it. (Author: @alx-xo)

Bug fixes

• Environment variables no longer save their masked placeholder #4152 - The MCP server "Authentication" tab could persist the server-redacted placeholder (e.g. sup*****) as the real value. Saving now only writes values you actually typed, removes them on an intentional clear, and otherwise leaves the stored secret untouched. (Author: @walker-tx)
• Clear guidance when tools fail to load without authentication #4016 - When MCP tools fail to load on a server with no authentication configured, the dashboard now shows actionable guidance with a "Configure authentication" deep link instead of a generic error. (Author: @linear-code)
• Assistant onboarding finds your existing integrations #4164 - Assistant onboarding now checks your existing toolsets first and includes tools proxied from external MCP servers in its search, instead of telling you integrations you already set up aren't available. (Author: @danielkov)
• Stable environment variable ordering #4150 - The environment variables table on the MCP server page no longer reorders its rows on every page refresh or tab focus change. (Author: @walker-tx)
• Cowork tool calls labeled in tool logs #4020 - Tool calls made by Cowork are now labeled cowork in tool logs, so filtering by Cowork source works. (Author: @linear-code)
• MCP attribution works with org-wide hooks keys #4155 - When the Claude hooks plugin authenticated with an organization-wide key, recovered MCP attribution never matched its telemetry rows and sessions stayed labeled "custom". Attribution is now matched by organization, so true server and tool names come through regardless of how the plugin authenticates. (Author: @subomi)
• Internal: dormant telemetry endpoint removed #4158 - The unused telemetry.queryRiskTokens endpoint, which computed a superseded billing population, is removed. (Author: @daviddanialy)