Protect your OpenAI key in 5 minutes
Replace your real OpenAI API key with a sanitized token you can cap, scope and revoke. Your code sends it to the proxy with two headers; the real key stays at the edge.
Prerequisites
- A KeyVault Edge account (free)
- An active OpenAI API key
- A project using the OpenAI Node.js or Python SDK
Step 1: Create a sanitized token
In the KeyVault Edge dashboard, go to Tokens → New Token.
Select OpenAI as the target provider. Enter your real OpenAI API key. It is encrypted with AES-256-GCM and never shown again.
Add the hosts allowed to use it (at least one): yourdomain.com, staging.yourdomain.com, and localhost for local development.
Copy the generated token. It looks like kvt_... and is a signed, encrypted envelope, so keep it in your environment like any credential.
Step 2: Update your environment variables
.env.local
# BeforeOPENAI_API_KEY=sk-proj-YOUR_REAL_KEY # After: the real key lives only in KeyVault EdgeKVE_TOKEN=kvt_...your_tokenThe proxy refuses the token from hosts outside its allowlist and logs the attempt.
Step 3: Point the SDK at the proxy
openai.ts
// npm install openai (no KeyVault SDK needed)import OpenAI from "openai"; const openai = new OpenAI({ // Placeholder: the proxy replaces the auth header with your real key. apiKey: "via-keyvault-edge", baseURL: "https://proxy.keyvaultedge.com/v1", defaultHeaders: { "X-KV-Token": process.env.KVE_TOKEN!, // kvt_... "X-KV-Target": "https://api.openai.com", // Server-side only: browsers set Origin themselves. Origin: "https://app.yourdomain.com", },}); const res = await openai.chat.completions.create({ model: "gpt-4o-mini", messages: [{ role: "user", content: "Hello from the edge" }],}); console.log(res.choices[0].message.content);That's it
Real OpenAI key never in your codebase; only the encrypted token is in your env
Breach alert fires if anyone tries to use your token from an unauthorized origin
Request logs in the KeyVault Edge dashboard