KeyVault.
Docs/Quickstart

Quickstart

From signup to a request flowing through the proxy. You keep your provider's SDK; you change its base URL and add two headers.

  1. 1

    Create an account

    Sign up at keyvaultedge.com/login. Plans from $9/month; see pricing for each plan's limits.

  2. 2

    Add an API key

    In the dashboard, go to API Keys → Add Key. Paste your real API key (e.g. your OpenAI sk-proj-... key). Select the provider. The key is encrypted and stored — you will never see it in plaintext again.

  3. 3

    Generate a sanitized token

    Go to Tokens → New Token. Select the key you just added. List the hosts allowed to use this token. You must list at least one (e.g. app.yourdomain.com, *.yourdomain.com). Click Generate and copy the kvt_... token. It's a signed, encrypted envelope: treat it like a credential and store it in your environment, not in source control.

  4. 4

    Swap the key for the token

    .env
    # BeforeOPENAI_API_KEY=sk-proj-YOUR_REAL_KEY # After: the real key lives only in KeyVault EdgeKVE_TOKEN=kvt_...your_token
  5. 5

    Send requests through the proxy

    Point your client at https://proxy.keyvaultedge.com, keep the provider's usual path (e.g. /v1/chat/completions), and send two headers:X-KV-Token with your token andX-KV-Target with the provider's base URL. Examples for each language are below.

Real API key encrypted inside the token, never in your codebase or CI
Requests from hosts outside the token's allowlist are refused and logged as breach events
Revoke a token from the dashboard and the proxy stops honouring it

Use it in your language

Initialise, then point your API calls at the proxy

Keep your existing provider SDK. Set its base URL to the proxy and add theX-KV-Token andX-KV-Target headers. The proxy verifies the token's signature, decrypts it, checks the caller's host against the allowlist, injects the real key and streams the response back unchanged.

# The proxy forwards the path to the X-KV-Target origin and injects# the real key. Server-side callers send an Origin that matches one# of the token's allowed hosts.curl https://proxy.keyvaultedge.com/v1/chat/completions \  -H "X-KV-Token: $KVE_TOKEN" \  -H "X-KV-Target: https://api.openai.com" \  -H "Origin: https://app.yourdomain.com" \  -H "Content-Type: application/json" \  -d '{    "model": "gpt-4o-mini",    "messages": [{ "role": "user", "content": "Hello from the edge" }]  }'

Other providers work the same way: keep the proxy URL and changeX-KV-Target to the provider's API base (e.g. https://api.anthropic.com,https://api.stripe.com). From a browser, the Origin header is set for you; from a server, send an Origin matching one of the token's allowed hosts.

OpenAI integration guide Back to docs