Where your provider key lives
You add a provider key in the vault window, a separate page at vault.keylayer.dev, so the dashboard never sees it. Keylayer encrypts it with AES-256-GCM under a random 256-bit key made for that credential and stores it in a Cloudflare Durable Object of its own. No screen or API shows it again; to replace it, you rotate the credential.
The key that decrypts it is locked with a secret that exists only inside the Keylayer keys you issue, and each Keylayer key is itself encrypted with a secret only our servers hold. We store Keylayer keys only as hashes, apart from the copies your vault keeps encrypted and, for 15 minutes after an API enrollment, a copy sealed with the key your enroll request sent. So the data we store can't decrypt your provider key on its own.
Keylayer is not end-to-end encrypted or zero-knowledge. When a request arrives with a valid Keylayer key, the relay uses it to decrypt your provider key in memory, adds it to the request to your provider and discards it once the request is sent. It's never written to disk or to logs in readable form.
When you revoke a credential, its encrypted key is erased. Cloudflare's storage history can keep earlier encrypted copies for up to 30 days.
Your passkey vault
Your vault holds the root keys that mint your Keylayer keys. It opens only with your passkey, your recovery code or a browser you linked. The vault's own keys are made on the vault page in your browser and never leave it unencrypted.
Vault passkeys are bound to vault.keylayer.dev, so keylayer.app and other sites can't use them. Signing in to the dashboard doesn't open the vault, and a vault session ends 15 minutes after it opens.
You get one recovery code: 128 random bits, written as 28 characters. While your vault has a passkey, the code opens it only after a 48-hour wait, we email you, and any unlock with your passkey cancels it. If you lose every passkey and the code, a vault reset empties the vault after 7 days, and we email you about that too.
Scoped keys
Your code never holds your provider key. It sends a Keylayer key, and the relay swaps it for your provider key on the way out.
Each key can carry up to 8 limits: a spend cap, a request cap, a rate limit, concurrency, expiry, an IP allowlist, allowed methods and allowed paths. A key you mint lasts 1 hour by default and 365 days at most, and a key made from another key never has looser limits than its parent.
Pausing or revoking a key refuses its next request, and a request that's already running stops within about 10 seconds. On every built-in provider except Groq, the routes that manage your provider account are blocked by default, so a Keylayer key can't be used to manage it.
Spend caps
A hard spend cap reserves the most a request could cost before forwarding it, and refuses requests it can't price. If a provider reports more than the reservation, Keylayer suspends the key, but that request has already run. An estimated cap lets some requests it can't price through on a small estimate, so spending can pass the cap.
Keylayer counts cost from providers' published prices and the usage they report, and caps don't limit what your provider can bill you. Set limits in your provider account too.
The activity trail
For each request, the activity trail records the Keylayer key and credential used, the provider, the path without its query string, query parameter names, your IP address and user agent, whether it was allowed and why, the status code, token counts, cost and sizes. It also records changes to your credentials and keys.
Requests refused by a key's own rules, such as an expired key, a blocked path or a spend cap, are recorded up to 60 a minute per key, 400 a minute per credential and 5,000 a day per credential, with a summary row for the rest. Refusals from rate limits, request caps, concurrency limits, daily caps and the flood limit aren't recorded, and neither are requests made with a revoked key.
Request and response bodies and query string values are never stored. Free keeps 7 days of activity and Pro keeps 90.
Sign-in
You sign in to the dashboard with Google. Signing in shows your credentials, keys and activity, but it can't open your vault.
Someone who phishes your Google sign-in can see what the dashboard shows and disrupt your workspace, such as revoking keys or starting a vault reset, which we email you about and your passkey cancels. They can't mint a key, reveal one or open your vault.
Infrastructure
The relay, the API and the vault run on Cloudflare Workers, and your encrypted keys are stored in Cloudflare Durable Objects. Their code has no runtime dependencies, and logging is off for the API, the relay and the vault page.
The relay connects to your provider only over HTTPS, to the provider's exact host, and doesn't follow redirects. It removes your IP address, cookies and forwarding headers, so requests reach your provider from Cloudflare's network.
Your workspace record, activity log and usage totals are kept in our Postgres database at OVHcloud in the EU. Stripe processes payments for Pro.
If something leaks
| What leaks | What it can do |
|---|---|
| A Keylayer key | Only what its limits allow, until it expires or you revoke it. |
| A copy of our key storage | Encrypted keys, hashes and metadata, none of which decrypts your provider key. |
| Our key storage and our server secrets | Still nothing that decrypts your provider key. That also takes a live Keylayer key, and we keep those only as hashes or encrypted in your vault. |
| Your Google sign-in | Disruption, such as revoking keys or starting a vault reset that your passkey cancels. No minting, no revealing keys and no opening your vault. |
| Your recovery code | Nothing at once while your vault has a passkey: the unlock waits 48 hours, we email you, and your passkey cancels it. |
Questions
Can Keylayer see my provider key?
Our relay can: it decrypts your provider key in memory for each request it forwards, then discards it. Keylayer is not end-to-end encrypted or zero-knowledge. At rest, nothing we store decrypts your provider key on its own.
Does Keylayer store my prompts?
No. Keylayer never stores request or response bodies, so no prompts, completions or files. The activity trail keeps metadata such as paths, status codes, token counts and costs.
What should I do if a Keylayer key leaks?
Revoke it in the dashboard. Its next request is refused and a request that's already running stops within about 10 seconds. Your provider key was never in it, so you don't need to replace that.
What if I lose my passkey?
Use your recovery code. While your vault has a passkey, the unlock waits 48 hours and we email you, then you enter the code again within 24 hours. If you've lost the recovery code too, a vault reset empties the vault after 7 days so you can set it up again.
Report a vulnerability
Email bart@bitgate.com with what you found and the steps to reproduce it. Our security.txt lists the same contact.
Test only against your own workspace, don't access other people's data, and don't run load or denial-of-service tests against Keylayer.