Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps. Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own device. Apps that want those keys ask the wallet for access, and the wallet sends […]
Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps.
Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own device. Apps that want those keys ask the wallet for access, and the wallet sends each request to the provider itself. The app gets a session token. The key stays in the wallet.
Byoky goes after the habit of pasting a key into a web app’s settings page to try a new tool. “A key pasted into a settings page is a key you no longer control,” the project’s homepage says. Byoky copies the model of MetaMask, the crypto wallet that decentralized apps connect to: the app asks, the user approves, and one click revokes access.
Users set a master password and add their keys. Byoky encrypts them with AES-256-GCM, a standard cipher that also detects tampering, using a key derived from the password through 600,000 rounds of PBKDF2. That iteration count makes each guess slow for anyone who steals the encrypted vault and tries to crack the password. Byoky requires a password of at least 12 characters.
Developers keep the official Anthropic or OpenAI library and hand it a session key and a fetch function from Byoky’s SDK. Streaming, tool calls and image inputs pass through, according to the documentation. Users can cap spending per app, and the wallet logs every request locally with the app’s origin, the provider and the status.
The wallet supports 13 cloud providers plus local Ollama and LM Studio servers. It can also translate between Anthropic, OpenAI, Gemini and Cohere request formats, so a user can drag an app written for Claude onto a GPT key without the developer touching code.
Command-line agents such as OpenClaw, Claude Code and Hermes connect through a local proxy called the bridge. The bridge rejects requests that lack a bridge token, a check meant to stop other programs on the same machine from spending the keys. It also does something less advertised. When a third-party agent runs on a Claude Pro or Max subscription token, the bridge renames the agent’s tools and moves its system prompt so that Anthropic’s first-party detection accepts the request.
Byoky is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
