Pro-tier only: store the publisher's BYO TTS key (Fernet- encrypted at rest). Free / Plus return 403 — the upgrade prompt on the frontend should route the publisher to /publisher/{slug}/ pricing instead.

Verification mirrors the listener-side flow: a probe call against the provider rejects typos with 422 before we persist anything. On success we stamp byo_tts_provider + byo_tts_encrypted_key on the Publisher row; subsequent renders pull the key out, decrypt in-process, and use it for the synthesis call.

Pool-safety (2026-08-11 SEV) — THREE PHASES

_byo.verify_key is a 10s-timeout httpx probe against the provider. Holding Depends(get_db) across it pins a writer connection for the full round-trip. Same shape, same fix as app/routes/byo_tts.py::listener_byo_tts_set: gate on a short session, release it, probe holding zero connections, then persist on a second short session.