GhostKey — AI Key Vault

GhostKey is a local-first security wallet for your AI API keys. Paste a key once — it's encrypted on your device and never leaves the extension. When another extension or web app needs to call an AI provider, GhostKey either proxies the request (injecting the key internally, so the requester only ever sees the response) or hands out a short-lived, revocable session token. The raw key stays in the vault. 100% client-side. No servers, no accounts, no telemetry. WHY GHOSTKEY Pasting raw API keys into random tools is how keys leak. Most "key manager" extensions still hand the key to whoever asks. GhostKey delegates revocable access instead — ideally a proxied call where the key is never exposed at all. SECURITY • AES-256-GCM authenticated encryption via the Web Crypto API • Key derived from your master passphrase with PBKDF2-HMAC-SHA-256, 600,000 iterations • The derived key is non-extractable and lives only in memory while unlocked • A fresh random IV for every write; tampering and wrong passphrases are rejected • Your passphrase is never stored, transmitted, or recoverable FEATURES • One encrypted vault for all your keys, working with major AI providers and any OpenAI-compatible endpoint (including local model runtimes) • Proxy requests so the key never leaves GhostKey • Short-lived, revocable session tokens (Allow once / Session / Always / Deny) • Full on-device audit log of every grant, deny, and request • Usage and estimated-cost tracking with a hard monthly spending cap and kill-switch • One-click key rotation and "revoke all sessions" • Clipboard paste guard that warns when a key is pasted into a web page • Encrypted export/import for backups • Side panel + quick-access popup, dark and light themes FOR DEVELOPERS Any extension or web app integrates in a few lines with the included client SDK — handshake, request access, proxy, release. A full runnable example is in the open-source repository. OPEN SOURCE GhostKey is MIT-licensed with no build step and no minification — what you install is exactly what runs, so anyone can audit the cryptography.