EN PT-BR
← Voltar ao feed
low

Byoky: open-source wallet keeps AI API keys encrypted on-device and issues session tokens to apps

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 03:00 · coletado há 1 hora

Byoky is an open-source wallet for AI API keys, offered as a Chrome and Firefox extension and as iOS and Android apps. It stores keys for OpenAI, Anthropic, Google Gemini and other providers encrypted on the user's device. Apps request access and receive only a session token, while the wallet proxies requests to the provider. The article is a product overview with no incident, vulnerability or threat activity.

Detalhes técnicos

  • Keys are encrypted with AES-256-GCM, using a key derived from the master password via 600,000 rounds of PBKDF2. The password must be at least 12 characters.
  • Developers keep the official Anthropic or OpenAI libraries and pass in a session key and a fetch function from Byoky's SDK. Streaming, tool calls and image inputs are supported.
  • Users can cap spending per app. Requests are logged locally with origin, provider and status.
  • It supports 13 cloud providers plus local Ollama and LM Studio servers, and can translate between Anthropic, OpenAI, Gemini and Cohere request formats.
  • CLI agents (OpenClaw, Claude Code, Hermes) connect through a local proxy called the bridge, which rejects requests lacking a bridge token to stop other local programs from spending the keys.
  • When a third-party agent uses a Claude Pro or Max subscription token, the bridge renames the agent's tools and moves its system prompt so Anthropic's first-party detection accepts the request.

Remediação

Not applicable. The tool is intended to reduce the risk of pasting API keys into web app settings pages.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 02/11/2026 03:00 · coletado 02/11 05:01 primeiro registro

    Byoky: open-source wallet keeps AI API keys encrypted on-device and issues session tokens to apps

    ler a análise desta fonte

    Byoky is an open-source wallet for AI API keys, offered as a Chrome and Firefox extension and as iOS and Android apps. It stores keys for OpenAI, Anthropic, Google Gemini and other providers encrypted on the user's device. Apps request access and receive only a session token, while the wallet proxies requests to the provider. The article is a product overview with no incident, vulnerability or threat activity.

    Technical Details

    • Keys are encrypted with AES-256-GCM, using a key derived from the master password via 600,000 rounds of PBKDF2. The password must be at least 12 characters.
    • Developers keep the official Anthropic or OpenAI libraries and pass in a session key and a fetch function from Byoky's SDK. Streaming, tool calls and image inputs are supported.
    • Users can cap spending per app. Requests are logged locally with origin, provider and status.
    • It supports 13 cloud providers plus local Ollama and LM Studio servers, and can translate between Anthropic, OpenAI, Gemini and Cohere request formats.
    • CLI agents (OpenClaw, Claude Code, Hermes) connect through a local proxy called the bridge, which rejects requests lacking a bridge token to stop other local programs from spending the keys.
    • When a third-party agent uses a Claude Pro or Max subscription token, the bridge renames the agent's tools and moves its system prompt so Anthropic's first-party detection accepts the request.

    Remediation

    Not applicable. The tool is intended to reduce the risk of pasting API keys into web app settings pages.