Bring Your Own Proxy
Run the KeyVault Edge proxy inside your own VPC, Kubernetes cluster, or server, with the same token validation and key injection. BYOP is an Enterprise option: the container image, Helm chart and source are provided to Enterprise customers on request (they are not publicly downloadable yet), so the install commands below show the shape of a deployment rather than public URLs.
When to use BYOP
Data residency requirements
SOC 2, HIPAA, or GDPR constraints that forbid traffic leaving a specific region or cloud provider.
Low-latency private networks
Your application servers and AI API calls are on the same cloud — no reason to route through a public proxy.
Custom middleware needed
You want to inject your own request logging, tenant routing, or payload transformation before forwarding.
Your own keys
The proxy runs with your deployment's own master and HMAC keys, so tokens are only decryptable inside your infrastructure.
If none of these apply, the hosted proxy at proxy.keyvaultedge.com is simpler — no infrastructure to manage.
Prerequisites
- →A KeyVault Edge account — tokens are issued from the dashboard regardless of which proxy handles traffic
- →Your MASTER_KEY, HMAC_KEY, and DASHBOARD_API_KEY from Vercel / your dashboard deployment
- →Node.js 20+ (bare metal), Docker 24+, or a Kubernetes cluster with Helm 3+
- →Outbound HTTPS access to your upstream API providers (OpenAI, Anthropic, etc.)
Setup
Deploy the proxy
Choose your deployment method. All three produce an HTTP server on port 3001 (configurable via PORT).
services: kve-proxy: image: ghcr.io/trevor-crypto243/keyvault-edge/byop:latest restart: unless-stopped ports: - "3001:3001" environment: PORT: "3001" MASTER_KEY: "${MASTER_KEY}" HMAC_KEY: "${HMAC_KEY}" DASHBOARD_API_URL: "https://keyvaultedge.com" DASHBOARD_API_KEY: "${DASHBOARD_API_KEY}" RATE_LIMIT_WINDOW_MINUTES: "1" RATE_LIMIT_MAX_REQUESTS: "1000" healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3001/v1/status"] interval: 30s timeout: 5s retries: 3Configure TLS (production)
The BYOP server speaks plain HTTP — put a TLS-terminating reverse proxy in front of it. Nginx or Caddy work well. If you're on Kubernetes, your ingress controller handles this.
# Nginx reverse proxy with TLS terminationserver { listen 443 ssl; server_name proxy.yourdomain.com; ssl_certificate /etc/ssl/proxy.crt; ssl_certificate_key /etc/ssl/proxy.key; location / { proxy_pass http://localhost:3001; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_read_timeout 60s; }}Point your token at the BYOP host
In the dashboard, go to Tokens → Edit and set the Proxy Host field to your BYOP URL (e.g. https://proxy.internal). The token will now only work when requests arrive through your proxy.
Test the connection
Replace the URL with your BYOP host and your token.
# Test the BYOP proxy is forwarding correctlycurl https://your-proxy.internal/v1/chat/completions \ -H "X-KV-Token: kvt_your_token_here" \ -H "Content-Type: application/json" \ -H "X-KV-Target: https://api.openai.com" \ -H "Origin: https://app.yourdomain.com" \ -d '{ "model": "gpt-4o", "messages": [{ "role": "user", "content": "Hello" }] }'A 200 from the upstream provider means end-to-end decryption and forwarding are working. Check GET /v1/status on the BYOP host for a health summary.
Environment variables
| Variable | Required | Description |
|---|---|---|
| MASTER_KEY | Yes | AES-256 key encryption key. Must match the value used by the dashboard. |
| HMAC_KEY | Yes | HMAC-SHA256 signing key. Must match the dashboard value. |
| DASHBOARD_API_URL | Yes | Base URL of your KeyVault Edge dashboard (e.g. https://keyvaultedge.com). |
| DASHBOARD_API_KEY | Yes | Internal API key for breach event logging back to the dashboard. |
| PORT | No | HTTP port to listen on. Default: 3001. |
| RATE_LIMIT_WINDOW_MINUTES | No | Rate limit window in minutes. Default: 1. |
| RATE_LIMIT_MAX_REQUESTS | No | Max requests per window. Default: 1000. |
| LOG_LEVEL | No | Logging verbosity: error | warn | info | debug. Default: info. |