KeyVault Edge Docs
Quickstart
Go from zero to a working sanitized token in under 5 minutes.
- Install the SDK
- Create your first token
- Replace in your codebase
- Test the proxy
SDK Reference
Full API reference for the KeyVault Edge Node.js and Python SDKs.
- Node.js SDK
- Python SDK
- REST API
- Webhooks
Security Model
How host-binding encryption works and our threat model.
- Token architecture
- AES-256-GCM encryption
- Host-binding
- Breach detection
Integration Guides
Step-by-step guides for every major API provider.
- OpenAI / GPT-4
- Anthropic Claude
- Stripe
- GitHub API
- AWS SDK
- Twilio
BYOP — Bring Your Own Proxy
Self-host the proxy in your own VPC, Kubernetes cluster, or bare-metal server.
- Docker Compose
- Helm chart
- Bare Node.js
- Nginx TLS termination
Ephemeral Sessions
Use the OpenAI Realtime API from the browser without exposing your API key.
- POST /v1/ephemeral
- 60-second client_secret
- WebRTC + DataChannel
- Audit logging
Client-side Decryption SDK
Self-hosted deployments only: decrypt tokens in your own runtime with your deployment's own keys.
- Requires a self-hosted deployment
- JavaScript, Python, Go
- Not on hosted plans
- SDKs not yet published
Quickstart
- 5 minutes to production1
Add your real key
bash
Dashboard → API Keys → Add Key# Paste the provider key (e.g. sk-proj-...). It is encrypted and never shown again.2
Create a token with at least one allowed host
bash
Dashboard → Tokens → New Token# Allowed hosts: app.yourdomain.com, *.yourdomain.com# Copy the kvt_... token: a signed, encrypted envelope. Keep it in your env.3
Swap the key for the token in your environment
bash
# BeforeOPENAI_API_KEY=sk-proj-YOUR_REAL_KEY # After: the real key lives only in KeyVault EdgeKVE_TOKEN=kvt_...your_token4
Point the provider SDK at the proxy and add two headers
typescript
// npm install openai (no KeyVault SDK needed)import OpenAI from "openai"; const openai = new OpenAI({ // Placeholder: the proxy replaces the auth header with your real key. apiKey: "via-keyvault-edge", baseURL: "https://proxy.keyvaultedge.com/v1", defaultHeaders: { "X-KV-Token": process.env.KVE_TOKEN!, // kvt_... "X-KV-Target": "https://api.openai.com", // Server-side only: browsers set Origin themselves. Origin: "https://app.yourdomain.com", },}); const res = await openai.chat.completions.create({ model: "gpt-4o-mini", messages: [{ role: "user", content: "Hello from the edge" }],}); console.log(res.choices[0].message.content);