Open source · No servers · No accounts

The MetaMask for API keys.

Keep every AI API key in one wallet. Apps connect to the wallet, the wallet makes their calls, and your keys never leave Byoky.

Start Building
Also on Firefox · iOS · Android · GitHub
~/my-appBYOKY WALLET · LOCAL
$ npx create-byoky-app my-app
> connect({ providers: ['anthropic'] })
◆ wallet: localhost:3000 wants to connect
✓ approved · key stays in the wallet
> POST /v1/messages 200 streaming_
Providers
13 supported
Servers
None. No accounts.
Encryption
AES-256-GCM
License
MIT

Add your keys once. Every app connects.

ChromeFirefoxiOS & SafariAndroidCLI

Add your keys once

Install the wallet, set a master password, and add your API keys or a Claude setup token. They're encrypted on this device.

Apps ask, you approve

Open any Byoky-enabled app. It asks for access to the providers it needs, and you decide.

The wallet makes the calls

Requests go from your wallet straight to the provider. The app gets a session token, never your key.

Works with any AI provider

Claude
OpenAI
Gemini
Mistral
Grok
DeepSeek
Cohere
Groq
Perplexity
Together AI
Fireworks
OpenRouter
Hugging Face
Replicate
Azure OpenAI
Ollama
Bedrock
LM Studio
Vertex AI

One wallet. Every AI app.

Apps connect to your wallet instead of asking for your keys. One click to approve, one click to revoke. Pick an app below to see what it could look like.

lovable.dev
lovable

Build something Lovable

Create apps and websites by chatting with AI.

Ask Lovable to create a dashboard that tracks…
📎➤
📊 Analytics dashboard🛍 Online store✈️ Travel planner📝 SaaS landing

Running on your own keys · unlimited prompts

This is a preview of how the Connect Byoky wallet button could appear on these apps. Byoky is not affiliated with any of them.

Stop pasting keys into apps.

A key pasted into a settings page is a key you no longer control. With Byoky, apps connect to your wallet the way dapps connect to MetaMask.

Providers

One wallet, every provider.

Anthropic, OpenAI, Gemini, Mistral and nine more, plus custom endpoints. Add a key once and use it in every Byoky-enabled app.

Control

Apps connect instead of copying keys.

Approve an app, see every request it makes, set spending caps, and revoke it with one click. No more sk-... in a settings page.

Groups

Switch keys by dragging an app.

Bucket connected apps by purpose (“Personal”, “Work”), pin each group to a credential, then drag apps between groups to change which key they use. Live sessions reroute without code changes.

Your Appconnected
→
Workgroup
→
Team keycredential
Cross-Provider

One app. Any provider.

Drag an app from a Claude group into a GPT group and the wallet translates on the fly: Anthropic ↔ OpenAI ↔ Gemini ↔ Cohere request bodies, response bodies and SSE streams.

Your AppAnthropic SDK
→
WalletTranslates
→
GPT-4oOpenAI API

No servers.
No accounts. No cloud.

Byoky doesn't run anything that sits between you and your provider. The wallet talks only to the AI providers you add. There is nothing to sign up for and nothing to sync.

0Byoky servers in the request path
0accounts to create
MITevery component open source, mobile apps included

Your keys are encrypted on your device. Moving them to another device is up to you, with an encrypted backup file.

Works where your apps run.

Each wallet serves the apps on its own device. Every path ends at a wallet you hold.

Desktop browser

Chrome and Firefox

Web apps connect through the Byoky browser extension. Keys live in the extension.

Web appSDK
→
ExtensionKeys here
→
LLM API
iPhone & iPad

Safari on iOS

The Byoky Safari extension, included with the iOS app, brings the wallet to Safari. Add your keys in its popup and web apps in Safari connect to it.

Web appSafari
→
Safari ext.Keys here
→
LLM API
In-wallet browser

Any web app on iOS and Android

Open any https app by URL in the built-in browser of the iOS or Android app. It connects through an injected wallet bridge, no extension needed.

Web appin-wallet
→
Mobile appKeys here
→
LLM API
CLI & desktop

Terminal tools and agents

@byoky/bridge is a localhost proxy that hands requests to the extension over native messaging. Works with OpenClaw, Claude Code and Hermes.

CLIHTTP
→
Bridgelocalhost
→
ExtensionKeys here
Your backend

Server-side LLM calls

Your server makes calls through the user’s browser over a WebSocket you host. Your backend never sees the key, and no Byoky server is involved.

Backendyour WS
→
BrowserSDK
→
ExtensionKeys here
Between devices

No sync. Bring your backup.

Wallets don’t pair or sync. To use your keys on another device, export a password-protected .byoky backup and import it there.

Walletdevice A
→
.byoky fileencrypted
→
Walletdevice B
OpenClaw × Byoky

Run Claude Code, Codex, and Gemini in OpenClaw.

Use the keys already in your wallet, or an existing Claude Pro/Max subscription via a setup token. The plugin routes through the local bridge, so your keys stay in the wallet even when the agent runs in your terminal.

Build AI apps.
Your users bring the keys.

Integrate with any AI provider using their native SDK. Just swap in Byoky's fetch. Keys never touch your app, and your users pay their provider directly.

npm install @byoky/sdk to add to an existing project · npx create-byoky-app to scaffold a new one

Native SDK compatibility

Works with official SDKs from Anthropic, OpenAI, Gemini, Mistral, and 9 more providers. Just swap in Byoky's fetch.

Streaming out of the box

Full SSE streaming support through the wallet proxy. No special handling needed.

Built-in connect modal

modal: true handles the connect flow. No wallet yet? It shows install links, and on phones it points users to the Byoky app's built-in browser.

Backend relay

Your server makes LLM calls through the user's browser over a WebSocket you host. Keys never leave the wallet, even server-side.

CLI & local apps

The Byoky Bridge lets CLI tools and desktop apps route through the wallet via a local HTTP proxy. Keys stay in the extension.

app.ts
import Anthropic from '@anthropic-ai/sdk';
import { Byoky } from '@byoky/sdk';

const byoky = new Byoky();
const session = await byoky.connect({
  providers: [{ id: 'anthropic', required: true }],
  modal: true, // built-in connect + install UI
});

// Use the native Anthropic SDK — keys never exposed
const client = new Anthropic({
  apiKey: session.sessionKey,
  fetch: session.createFetch('anthropic'),
});

Security isn't a feature. It's the architecture.

AES-256-GCM
PBKDF2 600K iterations. Keychain / Keystore-backed on mobile.
Zero key exposure
Keys never leave the wallet. Apps get per-session tokens.
Full audit log
Every request logged locally with origin, provider, and status.
Spending caps
Token allowances per app. The proxy enforces limits.
Encrypted backup
Export .byoky files protected by a separate password.
No servers
No accounts, no cloud sync, no relay, no telemetry.
Fully open source · MIT licensed · No hosted services
Star—
Read the Docs