Keys you never have to see
Provider keys live encrypted in a vault your team contributes to without exposing them. A shared pool with round-robin failover keeps requests flowing when a key rate-limits or dies.
A key can reach you without passing through you
The person who owns the key is often not the person who runs the account. Send an invite and they paste the key on their own machine, with no login and no account. It is encrypted before it is stored, and what you see afterwards is the first four characters and the last four.
No secret in a chat window
The invite token is the credential. It expires, and it is the only thing that travels.
Masked preview, always
sk-o…3f9a
No endpoint returns the secret. Not to an admin, not to an agent.
One link, several keys
A single invite can collect a whole set of providers, with a progress bar the contributor can see.
Three kinds of key, and they do not mix
This is the part that matters for money. Free and subscription keys join the shared pool, because the cost is already paid. A pay-as-you-go key never does — one tenant quietly spending another tenant's money is the failure you cannot apologise your way out of.
Free
A free-tier account. Pools freely, so everybody's quota adds up.
Subscription
A flat monthly coding plan. Pools, and meters against the plan's own rolling window.
Pay-as-you-go
Metered per token. Never pools. Held by a database trigger, a constraint, and a rejected write.
One key dies, the request does not
Every request picks the healthiest, least-used key. Three consecutive errors drop a key from selection, and the next request simply completes on the next healthy one. Nothing to page anyone about at 2am.
healthy first then least-used today then least-recently-used 3 consecutive errors -> dropped from selection recovers -> back in rotation
Spend and quota, per key rather than per month
Every request is logged against the key that served it, so cost reads per key instead of as one number you cannot act on. Requests today, requests this minute, tokens this month, and what each key has cost you.
Per-key spend
Find the key behind a bill, not just the total.
Quotas that fill
Set a daily, minute, hourly or monthly ceiling and watch the meter against it.
Health you can see
Healthy, degraded or dropped, per key, with the last time it served.
A dead key is repaired in place, not rebuilt
When a credential stops working the contributor gets a re-authentication link and replaces it themselves. Same key, same limits, same history — and the gateway picks it up without a restart.
key fails -> contributor emailed a re-auth link
-> they paste a fresh secret
-> same id, same limits, same historyGet your keys out of a .env file
Start with one. The pool gets better every time somebody does.
Open the Vault