Key Tokens: capped, revocable stand-ins for the LLM keys your coding agent holds
A local proxy that gives each tool its own capped key with a kill switch. Developers and small teams pay monthly.
Crowded · OpenCode breach drains users' API keys
Written for: Small startup team, Solo builder
Next step
This week, ship the localhost proxy with a one-line OpenCode config that swaps a raw key for a $5-a-day capped token. Post it in OpenCode's Discord and on r/LocalLLaMA while the breach is still being discussed.
Why now
The earlier Key Tokens card was based on the idea that stolen keys feed distillation. Now a well-known open-source coding agent has lost real user keys, and users got real bills. Every OpenCode user who pasted a raw provider key is a warm prospect this week. Developers also spread keys across more providers as cheap flash models launch, so each person has more keys to lose.
What became possible
Attackers got into part of OpenCode's online platform, a popular open-source alternative to Claude Code and Cursor. They stole users' API keys and ran up charges on their AI accounts. The AI tools the team asked for help also refused to look at the malicious code.
Two ways in
- Key Tokens proxy
An open-source localhost proxy that keeps the real OpenAI, Anthropic and OpenRouter keys in the OS keychain. It hands each tool a stand-in token with a daily dollar cap, a model allowlist and one-click revoke. It ships with ready-made configs for OpenCode, Codex CLI and Claude Code.
- Customer
- Individual developers running several coding agents on their own keys
- Model
- Free OSS. A $8 per user per month team tier adds shared caps, Slack alerts and an audit log
- Leak Bill Alarm
Polls provider usage APIs every few minutes. If spend jumps past your usual rate, it alerts you and rotates the key automatically.
- Customer
- Indie hackers and freelancers who have been burned by surprise bills
- Model
- $5 per month prosumer subscription
Competition
The scoped, capped, revocable stand-in key is already standard gateway functionality. OpenRouter's user-authorized capped keys come closest to the dev-tool BYOK case, and Byoky already does short-lived session tokens with per-app caps.
Full competition notes (9 competitors)
The scoped, capped, revocable stand-in key is already standard gateway functionality. OpenRouter's user-authorized capped keys come closest to the dev-tool BYOK case, and Byoky already does short-lived session tokens with per-app caps. LiteLLM, Portkey, Telnyx, TokenProxy and OrcaRouter all issue virtual keys with budgets. The one opening left is a neutral token standard that many tool vendors adopt and that works directly with the providers' own keys, where the value comes from the network rather than the proxy. That needs adoption by both tool vendors and model providers, and the providers' own scoped project keys or OpenRouter extending its sign-in flow could make it unnecessary. The Distillation Alarm space is early but weak as a standalone product. Distillation hurts the model providers, who run their own detection. Real campaigns spread across thousands of accounts, so watching one company's usage exports catches little. Methods are already public in research. It fits better as an anomaly or misuse feature inside a broker or gateway, sold as catching a compromised or misused key rather than model extraction.
- OpenRouter (OAuth PKCE keys and provisioning API keys)
Dev tools can get user-authorized keys with credit caps that can reset daily, weekly or monthly, or create, cap and disable keys from their server. BYOK usage can count toward the caps. This is very close to the broker-token idea.
- Telnyx LLM Token Gateway
Issues token keys with model allow-lists, budget and rate limits, per-user binding and immediate revocation.
- Byoky
Open-source browser key wallet. Apps get short-lived session tokens instead of raw keys, with per-app and per-provider spend caps enforced in a proxy. This is almost exactly the user-held version of the idea.
- TokenProxy
Rust BYOK gateway that issues per-developer or per-project proxy keys with their own limits. Maturity is unverified.
- OrcaRouter
Per-agent scoped keys, pitched as limiting the damage a compromised agent can do.
- LiteLLM Proxy virtual keys
Widely used open-source gateway with virtual keys, per-key budgets, model scoping and revocation sitting in front of real provider keys. Listed from prior knowledge, not from these searches.
- Portkey virtual keys
Commercial AI gateway that stores provider keys in a vault and issues virtual keys with budget limits. Listed from prior knowledge, not from these searches.
- DeepInspect
Startup publishing on detecting model distillation attacks in AI traffic. It is the closest thing found to the Distillation Alarm.
- Embarrassingly Simple Detector for Model Extraction (arXiv 2606.05725)
June 2026 research on detecting extraction by comparing traffic windows with historical benign traffic. It is not a product, but the method is public.
Checked 2026-10-18
Risks
- Providers already offer project keys and workspace limits, and could add per-tool caps natively
- Cloudflare AI Gateway and OpenRouter already sell spend caps
- Users have to trust you with their keys, so the product has to be local-first and auditable
Strong tech readiness and team fit; open space is the weak point (5).
tech 9 · pull 6 · space 5 · fit 9 · build 9
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
Status history
- 2026-10-18 Flagged as buildable