Your key
will leak.
The real key is encrypted and lives inside proxykey. What goes out is only a pass — bound to your IP, capped by limits, revoked in one click. Stealing it is pointless.
The reality of leaks
One leak — two outcomes
Full API access, from any address, with no limits. Your balance drains for days while you sleep.
Foreign IP — denied. Limits — a wall. And the original is encrypted and never leaves proxykey at all.
How the key is protected
Not "we'll rotate it if something happens" — the leaked key is useless before you even notice it's gone.
One place for everything
OpenAI, Anthropic, Google, Mistral — in one panel. Reissuing any key takes a second, with zero downtime.
The built-in MCP server hands AI agents passes instead of real keys. An autonomous agent will never see the original.
Inside the panel
A human enters the real key — once. From then on, apps and AI agents only ever receive a pass, and everything else is visible and managed in the panel.
A pass
instead of the key
Every real key gets its own pass with a prefix, limits and IP binding. Revoked in one click — the original is never touched.
IP and limits —
you set them
A pass works only from your address and stops at your rpm/rpd. A request from a foreign IP or over the limit gets an instant denial — not a charge on your balance.
Every request
is visible
Method, path, status and latency of every request — in real time. Errors and limit denials are highlighted immediately, no external dashboards needed.
MCP for
AI agents
Connect an agent to the built-in MCP server with one URL and an mcp_… token. It creates, rotates and revokes passes on its own — but the real key stays out of reach. Only a human can enter the original, in the panel.
Frequently asked questions
FAQHow do I hide my API key from an AI agent?
Don't give the agent a secret — give it a virtual key. You store the real key in proxykey once; it is encrypted with AES-256-GCM and never leaves the server. The agent gets a pass (vlt_…) that only works through the proxy, is bound to an IP, capped by rate limits, and revocable in one click. Anything that enters a model's context should be treated as published — so only put things there you can afford to revoke.
What is a virtual API key?
A separate token you hand out in place of your real key. It points at the original but never contains it and cannot be used to read it. Each virtual key carries its own limits: allowed IPs, requests per minute and per day, an expiry date, and its own request log. One client, one key — revoking one leaves the others untouched.
Can I give an app a different key instead of my real one?
Yes — that is the whole point. In your code you change only the host: instead of https://api.openai.com/v1/… you call https://api.proxykey.org/p/openai/v1/… and send a pass instead of the real key. Path, method, body and other headers stay exactly the same; the proxy injects the real credential server-side. It is a two-line change and no SDK rewrite.
How is a credential proxy different from a secrets manager?
A secrets manager (Vault, Doppler, a .env file) eventually hands you the real secret — from then on it lives in process memory, environment variables, logs and agent context. A credential proxy never hands it over: the secret is injected into the request at the network boundary, server-side. That is why a leak of what you distributed costs you nothing.
What happens if a virtual key leaks?
Almost nothing. A request from a foreign address is rejected, rate limits stop anyone draining your balance, and you revoke the key with one click — without rotating the real key, so your other integrations keep running. Compare that with a leaked real key: full access from any address with no limits, fixable only by rotating it everywhere at once.
Which APIs are supported?
OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, OpenRouter, Together, Cohere, Perplexity, Telegram Bot API, Stripe, Slack, Discord, GitHub, SendGrid, Resend, Notion, Airtable, Cloudflare, Supabase — plus openai-compatible and generic-rest modes for any custom HTTP API with any auth scheme.
How much does it cost?
Free, no credit card. Sign in with GitHub or an email magic link.
Let the key leak.
Let it cost you nothing.
Set up your first key in a minute. We encrypt and hide the real one — you get a pass and full control over it.
Protect your keys for free →