Bring your own keys

Where your keys go

They are saved in this browser’s local storage, under this site’s origin, and nowhere else. There is no account and no database. Clearing your browser data, or pressing Remove beside a key, deletes it completely.

Each request attaches the relevant key as a header. The server uses it for that one call to TypeSafe or Anthropic and then drops it — it is never written to a log, a session or a store. TypeSafe’s API sends no CORS headers, so calling it straight from the page is not possible; the request has to pass through the server either way.

What that means honestly

A key kept in browser storage can be read by anything able to run script on this origin. That is true of every credential stored this way, here and everywhere else. Two things follow, and neither is unusual: use a key you are willing to rotate, and delete it when you are finished. TypeSafe keys are free to regenerate from the console.

The requests themselves cost real money on your account — small amounts, and the meters on each demo show exactly how much as it is spent. A wikirace is a fraction of a cent; the snake at six moves a second is roughly forty-five cents an hour on Jev, and considerably more on Claude.

Saving a key also tests it. The test makes one read-only call that lists your models, and sends the key nowhere else.