Backstop docs
docs

BYOK setup

Backstop asks an LLM to describe every screenshot. You pay the LLM provider directly. This page shows how to set up a key and cap costs.

Why BYOK

  • Privacy. Your screenshots go to your LLM provider under your account, never to us.
  • Cost transparency. You see LLM spend in your provider’s dashboard. We don’t intermediate.
  • Choice. Pick the model that fits your budget and quality bar.

Supported providers (v1)

  • OpenAI — recommended default (gpt-4o-mini for the price/quality trade-off).
  • Anthropic — recommended for stricter refusal behavior on ambiguous content.
  • Google — supported via the Gemini API.
  • OpenAI-compatible self-hosted — for advanced users running vLLM, llama.cpp with an OpenAI shim, etc.

Set up a key

  1. Create an API key at your provider (OpenAI: platform.openai.com → API keys).
  2. In the parent web app, go to Settings → LLM provider.
  3. Pick your provider and paste the key.
  4. Pick a model. The default is the cheapest capable vision model for your provider.
  5. Click Test. The parent app runs a synthetic screenshot through your key to confirm it works.

Your API key is transmitted to your enrolled endpoints inside a payload encrypted under your family key. On each endpoint it is stored in the OS keychain (Windows DPAPI or macOS Keychain). It is never persisted on our servers.

Cost caps

To prevent runaway bills:

  • Monthly cap (US dollars). If your endpoints have spent this month’s cap, screenshots are dropped until the next month or you raise the cap.
  • Per-day cap. Same, per day.
  • Warn-at percentage. We email you when spend hits this fraction of your cap.

We compute an estimate from the number of screenshots taken and each provider’s public price. It won’t match the provider’s bill exactly, but it’s tight enough to stop surprises.

Rotating a key

  • Create the new key at your provider first.
  • Paste it into Settings → LLM provider → Rotate in the parent app.
  • The parent app pushes an encrypted config update to endpoints.
  • Once endpoints report the new key as active, revoke the old key at your provider.

If your key is disabled or rate-limited

The endpoint retries with backoff, then queues screenshots locally up to a bound. The parent app shows a warning. Fix the key or raise your provider’s rate limit; the queue drains automatically.