Comparison

KeyVault Edge vs writing your own proxy

A serverless function that reads the key from a server-only environment variable and forwards the request is the classic fix, and for one app it's often enough. The work is in everything around it once the endpoint is public.

Pick a DIY proxy if

You have one app, you're comfortable owning the code, and you don't want a third party in the request path.
You already run a backend that can make the call.
Your hosting's free tier covers it and you're happy to add your own auth and rate limiting.

Pick KeyVault Edge if

You want per-app tokens with allowed hosts, endpoints, rate limits and a monthly cost cap without writing them.
You want to revoke one client in a click, and rotate the provider key without redeploying.
You want blocked-attempt alerts, auto-quarantine on anomalies and an evidence export for billing disputes.

Side by side

	KeyVault Edge	a DIY proxy
Real key stays off the client
Time to first protected call	Minutes: paste the key, mint a token	Write, deploy and maintain the function
Stops anyone else calling your endpoint	Host allowlist, endpoint allowlist and per-token rate limits built in	Only what you add: the bare function forwards for anyone
Monthly cost cap per client		Build it (count tokens per model price)
Revoke one client without rotating the key		Build a token layer
Usage log, blocked attempts, evidence export		Add logging yourself
Third party in the request path	Yes (our edge proxy)	No
Cost	$9/month, or $90 once for 12 months	Your hosting bill (Workers and Vercel both have free tiers)

If you do build it, don't skip these

Keep the key in a server-only variable (on Vercel and Vite, never a NEXT_PUBLIC_ or VITE_ prefix). Add an allowlist of the exact upstream paths you call, so a leaked endpoint can't be pointed at more expensive ones. Add rate limiting per caller, not just globally. Log every call with enough detail to show your provider what was abuse. And set the provider's own spend cap where one exists.

Our guide for Google AI Studio exports includes a minimal Vercel function you can start from.

See it work before you decide

The free sandbox adds a fake key to a new account and sends three real requests through the proxy: one allowed, one from a foreign site, one to a blocked endpoint. No real key needed. Plans start at $9/month, or $90 once for 12 months with no auto-renewal.

Sources

Checked November 2026. Products change; if something here is out of date, email support@keyvaultedge.com and we'll fix it.