Autonomous Coding Agents That Don't Need Your API Keys in a Vendor's Cloud

If you want an autonomous coding agent without handing a vendor your API keys, run one where both the agent loop and your keys stay on infrastructure you control. The open-source options are OpenHands self-hosted and Autopilot with Hotcell. Factory offers an air-gapped deployment on its Enterprise plan, and its CLI keeps your own model keys on your machine. Cloud agents like Devin, Codex cloud tasks, Claude Code on the web, Cursor Cloud Agents and Amp Orbs all run in the vendor's infrastructure, and several now offer hybrid modes where only command execution moves to your machines.

"Giving a vendor your keys" means three different things, and each tool answers them differently. This guide breaks them down, based on each vendor's docs. Last reviewed October 2026.

#Three questions to ask any agent

1. Where does the agent loop run? The agent loop is the part that plans, calls the model and decides what to do next. If it runs in the vendor's cloud, your code and conversation pass through it, even when commands run on your machine.
2. Where does your model API key go? Some tools keep a bring-your-own key on your machine. Others store it in your account, or route every request through their servers. Some don't accept your key at all.
3. Where do task secrets go? Agents often need database URLs, tokens or cloud credentials to do real work. Most cloud agents store these with the vendor and inject them into the agent's environment as variables.

#At a glance

#Fully on your own infrastructure

Autopilot with Hotcell is our stack. Autopilot is a terminal coding agent that runs on your machine with your own key for any of 25+ providers, including local models through Ollama or LM Studio. On OpenRouter, for bigger tasks it sends read-only subagents into Hotcell sandboxes on the same machine. Hotcell keeps real keys on the host: each sandbox gets a short-lived token that a local gateway swaps for the key, with per-sandbox spend caps and revocation. GitHub works the same way, so sandboxes can git push without holding your token. There's no vendor cloud in the loop; the only outside service is the model provider you choose. The limit to know: the token swap only covers credentials sent in HTTP headers, so database passwords still have to be injected if a task needs them.

To run this stack without wiring it up yourself, run npm install -g directionallylocal, then dl. It asks whether agents should run on this computer or on your own server over SSH, and keys are stored there, never inside a sandbox. dl works with OpenRouter, DeepSeek, OpenAI, Ollama and other providers. You pick one during setup. See the docs.

OpenHands (MIT) runs fully self-hosted on a laptop, a VM or Kubernetes, with the agent in a Docker sandbox. Your model key stays in your deployment. Custom secrets are exported as environment variables in the agent's runtime, so the agent can read them. OpenHands Cloud and an Enterprise VPC option exist if you'd rather not run it yourself.

Factory supports cloud, hybrid and fully air-gapped deployments, the last two on Enterprise plans. Its CLI keeps bring-your-own keys in a local settings file and, per Factory, doesn't upload or index your codebase. Factory's cloud features, like Droid Computers and cloud environments, store secrets with Factory and inject them as environment variables.

#Hybrid: execution on your machines, agent loop in the cloud

Several cloud agents now let commands run on hardware you control while the agent loop stays with the vendor:

• Devin Outposts run sessions on your machines, but Devin's planning and inference stay in Cognition's cloud. Devin doesn't accept third-party model keys at all.
• Claude Code self-hosted environments (public beta, Team and Enterprise) keep repository checkouts, secrets and files on your runners, while the conversation still goes to Anthropic's API.
• Cursor My Machines and Team Pools run tool calls on your hardware; Cursor says the agent loop still runs in its cloud.
• Amp runners run threads on a machine you control, managed from ampcode.com. Amp states that self-hosting isn't offered.

These keep secrets and build artifacts off the vendor's machines, which is a real improvement. But your code still reaches the vendor through the conversation, and the vendor's control plane can still direct commands on your hardware.

#Cloud agents, and how they handle secrets

The fully hosted agents have improved their secret handling, and the details differ:

• Codex cloud tasks make secrets available only to setup scripts and remove them before the agent runs. Agent internet access is off by default.
• Claude Code on the web keeps your GitHub credentials on Anthropic's servers and out of the session VM. Its "network secrets" keep other keys outside the VM too, attaching them only to requests to hosts you list. Plain environment variables, by contrast, are readable by anyone using the environment.
• Cursor Cloud Agents offer runtime secrets that are redacted in tool output and transcripts, though still present as environment variables.
• Devin encrypts secrets at rest and binds them as environment variables when commands need them.
• Amp Orbs run on cloud machines hosted by E2B; secrets are delivered to new Orbs when they start and masked in shell output.

In every case, the vendor stores the secret. Whether that's acceptable depends on your compliance requirements and threat model.

#Keeping keys away from the agent itself

Hosting is only half the problem. Even a fully local agent usually holds your key in an environment variable or config file that its own shell commands can read. A prompt injection in a repository file or web page can then ask the agent to print or send it.

The fix is the same one the better cloud agents use, applied locally: keep the real key with a broker outside the agent's reach and give the agent something less valuable. Hotcell does this for agents on your own hardware with per-sandbox tokens, spend caps and default-deny egress. Our guide on stopping coding agents from leaking API keys through subagents shows the setup.

#How to choose

#FAQs

#What's the difference between bring-your-own-key and self-hosted?

Bring-your-own-key means you pay the model provider directly. It says nothing about where the agent runs or whether the vendor sees your key. Cursor, for example, routes BYOK requests through its own servers. Self-hosted means the agent itself runs on your infrastructure.

#Is Devin available self-hosted?

Not fully. Devin's planning and inference always run in Cognition's cloud. Outposts let sessions execute on your machines, and Enterprise customers can get a single-tenant VPC hosted by Cognition. Devin doesn't support third-party model API keys.

#Do local agents send my code anywhere?

They send prompts, including code snippets, to whichever model provider you configure. To keep code entirely on your machines, pair a local agent with a self-hosted model through an OpenAI-compatible endpoint.

#Which of these are open source?

OpenHands (MIT), Autopilot (MIT), Hotcell (Apache-2.0) and the Codex CLI (Apache-2.0). Devin, Factory, Amp, Cursor and Claude Code are proprietary.