Byoky wallet keeps AI API keys out of web app settings pages

Byoky is a free open source wallet for AI API keys, the secret codes that let a program use a model. It works as a Chrome and Firefox extension and as iOS and Android apps. Users keep keys for OpenAI, Anthropic, Google Gemini and others on their own device. An app tells the wallet to get access, and the wallet sends each request to the provider.

How it works

Byoky encrypts keys with AES-256-GCM, with a key from the master password. The password needs 12 characters or more. Users can limit spend for each app, and the wallet logs each request on the device. It works with 13 cloud providers.

The numbers

The source gives no audit and no test results. Its numbers give the design, for example 600,000 rounds of PBKDF2, which make each password guess slow.

What the other side says

Command line agents connect through a local proxy called the bridge. A third party agent can use a Claude Pro or Max subscription token. Then the bridge renames the tools of the agent and moves its system prompt. The first party detection of Anthropic then accepts the request. The source gives no comment from Anthropic.

Insight: Keys are a target and a control point

Symantec reported on October 15 that Aoki malware steals AI tool tokens. These give an attacker the identity and API quota of a developer. Byoky puts keys in one vault. Its bridge also works around a vendor check. This reads as users, tool makers and model vendors in a fight over who decides which program can spend a key.