KeyVault.
Docs/SDK Reference

Proxy Reference

There is no KeyVault Edge SDK to install: you use your provider's own SDK or plain HTTP, pointed at the proxy with two headers. Keys and tokens are managed in the dashboard.

Request headers

X-KV-Token: your kvt_... token. Required.

X-KV-Target: the provider API base, e.g. https://api.openai.com. Required; must be a public https URL. Only its origin is used.

Origin (or Referer): checked against the token's allowed hosts. Browsers send it automatically; server-side callers must send one that matches. If neither is present the proxy falls back to the Host header, which is the proxy's own host and will not match your allowlist.

The request path and query are forwarded unchanged: https://proxy.keyvaultedge.com/v1/chat/completions → https://api.openai.com/v1/chat/completions. The proxy strips the KeyVault headers and sets the provider's auth header with your real key.

cURL
# The proxy forwards the path to the X-KV-Target origin and injects# the real key. Server-side callers send an Origin that matches one# of the token's allowed hosts.curl https://proxy.keyvaultedge.com/v1/chat/completions \  -H "X-KV-Token: $KVE_TOKEN" \  -H "X-KV-Target: https://api.openai.com" \  -H "Origin: https://app.yourdomain.com" \  -H "Content-Type: application/json" \  -d '{    "model": "gpt-4o-mini",    "messages": [{ "role": "user", "content": "Hello from the edge" }]  }'

Proxy endpoints

ANY/<provider path>
POST/v1/ephemeral
POST/v1/validate
GET/v1/status

Error responses

Errors from the proxy itself are JSON: { "error": { "message", "detail", "status" }, "provider": "keyvault-edge" }. Provider errors pass through unchanged.

400Missing X-KV-Target, or malformed token
401Missing X-KV-Token, or token expired
402Token reached its monthly cost cap
403Invalid signature, host not allowed, endpoint not permitted, or token revoked
422X-KV-Target is not a public https URL
429Rate limit exceeded (Retry-After header set)
503Token could not be decrypted (transient)

Webhooks

Configure a webhook endpoint in the dashboard to receive breach and token lifecycle events.

token.breach.unauthorized_hostToken used from a host outside its allowlist
token.breach.invalid_hmacTampered or forged token presented
token.breach.expiredExpired token presented
token.quarantinedToken quarantined
token.revokedToken revoked
proxy.health.degradedProxy health degraded
proxy.health.recoveredProxy health recovered
Quickstart Back to docs