Simple, honest pricing
Plans include overage billing ($0.50 per 10,000 requests on Developer and Starter, $0.20 on Pro) above your limit, so you never get cut off mid-launch.
Frequently asked questions
Is there a free trial?
Yes. Every new account gets 14 days with Developer plan limits, no card needed. After that, choose a plan to keep your tokens working; if you don't, they stop proxying requests.
What counts as a proxied request?
Every API call that passes through the KeyVault Edge network counts as one proxied request. That includes token validation, decryption, key injection, and forwarding to your upstream provider.
Can I use KeyVault Edge with any API provider?
Yes. KeyVault Edge is provider-agnostic. It works with OpenAI, Anthropic, Stripe, GitHub, AWS, Twilio, and any HTTP-based API. You point your request at our proxy endpoint instead of the provider's endpoint.
What happens if I exceed my monthly request limit?
We bill overage at $0.50 per 10,000 requests on Developer and Starter, $0.20 on Pro above your plan limit, or you can upgrade to the next tier. You will receive an alert before overages begin.
How does host-binding work?
When you create a token, you list the hosts (exact hostnames or wildcard patterns) allowed to use it; at least one is required. On every request the edge proxy verifies the token's signature, decrypts it, and checks the request's Origin/Referer against that list. From any other host the request is refused with 403, nothing is forwarded, and a breach event is recorded. A server-side caller can set its own Origin header, so pair host-binding with rate limits and cost caps.
Do you store my real API keys?
Yes, encrypted with AES-256-GCM using envelope encryption: a per-token data key, wrapped by a master key held as a Cloudflare Worker secret. Keys are never logged in plaintext and are decrypted in Worker memory when a request is processed.
What is a Customer-Managed Encryption Key (CMK)?
Customer-managed keys (your own AWS KMS, GCP Cloud KMS or Azure Key Vault key wrapping each per-token DEK) are on the Enterprise roadmap and not live yet. Today, Enterprise customers who need to hold the keys can run the self-hosted proxy with their own master key.