Skip to main content
Every bot has a deployment mode, decided at creation. Managed bots come from the Bot Factory and are served by pro-bot.dev. Self-hosted bots are registered from the sidebar bot switcher and embed inside your own web app via the probot-self-hosted npm package.

​
At a glance

​
How your LLM key is handled

In managed mode your LLM API key is envelope-encrypted at rest: a per-bot Data Encryption Key (AES-256-GCM) wraps the key itself, and a Key Encryption Key (KEK) held outside the database wraps the DEK. On each chat request the server unwraps the DEK, decrypts the key in memory, calls the provider, and discards the plaintext - a database-only leak reveals nothing usable. See BYO-key flow for the full detail. In self-hosted mode the widget calls a sendMessage function you provide, which typically POSTs to a same-origin /api/… route on your own backend. Your LLM key lives there and never touches pro-bot.dev. Use the createOpenAIHandler helper (server-only) to call any OpenAI-compatible endpoint.

​
When to self-host

Choose a self-hosted bot when you want the chat inside your own web app, your LLM key entirely under your control, and the bot config version-controlled with the rest of your code. Everything you need is in Self-hosting your bot.

​
When managed is enough

For most job seekers the managed mode is the fastest path: there’s nothing to install, the key stays envelope-encrypted on pro-bot.dev, and you can export or delete everything at any time.