Simple, honest pricing
All paid plans include overage billing at $0.20 per 1,000 requests above your limit, so you never get cut off mid-launch.
Frequently asked questions
What counts as a proxied request?
Every API call that passes through the KeyVault Edge network counts as one proxied request. That includes token validation, decryption, key injection, and forwarding to your upstream provider.
Can I use KeyVault Edge with any API provider?
Yes. KeyVault Edge is provider-agnostic. It works with OpenAI, Anthropic, Stripe, GitHub, AWS, Twilio, and any HTTP-based API. You point your request at our proxy endpoint instead of the provider's endpoint.
What happens if I exceed my monthly request limit?
We apply overage billing at $0.20 per 1,000 additional requests above your plan limit, or you can upgrade to the next tier. You will receive an alert before overages begin.
How does host-binding work?
When you create a sanitized token, you specify which domains or IP ranges are authorised to use it. The token is cryptographically bound to those hosts using AES-256-GCM. If the token is used from any other host, decryption fails and the request is blocked - even if the attacker has the token.
Do you store my real API keys?
Your real API keys are stored encrypted at rest using AES-256-GCM with per-key envelope encryption. They are never logged in plaintext and are only decrypted transiently in isolated V8 memory during request processing.
What is a Customer-Managed Encryption Key (CMK)?
On the Enterprise plan, you can provide your own AWS KMS, GCP Cloud KMS, or Azure Key Vault key. KeyVault Edge uses your key to wrap each per-token DEK - meaning we hold only ciphertext. Even a full database breach gives an attacker nothing they can decrypt without your KMS key.