Unseenkey
Your AI uses your API keys. It never sees them.
Unseenkey keeps your keys in an encrypted vault on your own machine and gives Claude Code, Cursor, your scripts and the people you hire a handle instead. A handle works only through Unseenkey, within rules you set, and every call is logged.
A leaked handle costs you nothing. A leaked key costs you until you notice.
Keys leak faster than ever, and AI tools speed it up.
GitGuardian scanned every public GitHub commit made in 2025. Every one of these leaks started as a real key in a file, a chat or a config. A handle in the same place is worthless.
Two minutes with Claude Code
Add the key once. From then on every tool gets a handle, and the broker does the rest.
Paste a key and Unseenkey works out the provider, locks the key to that provider's websites and sends one read-only request to check that it works. 65 providers are built in, among them OpenAI, Anthropic, Stripe, AWS, GitHub, Google, Supabase, ElevenLabs and DeepSeek, plus any other host. The daemon starts itself, listens on loopback only, and locks when you walk away.
How it works
The key never leaves the vault except inside a request the rules allowed. Watch an allowed call go through, and a forbidden one stop at the broker.
You stay in charge, in plain words.
Risky calls wait for you. Everything else just works. And an AI tool on your machine cannot say yes on your behalf.
Claude Code wants to use your Stripe key to send a request to
POST api.stripe.com/v1/refunds
Refunds move money out, so it asks you first.
Your answer is confirmed with Windows Hello or your password
- Claude Code used openai: sent api.openai.com/v1/chat/completions · OK
- “contractor” was stopped from using stripe-live: the rules for this access do not allow it
- Check nothing was changed: the activity log is intact
How careful should it be?
One setting decides what AI tools may do with a key on their own.
Three ways a key leaks. One fix.
Every SDK, .env file and AI agent asks for the raw key. Once it exists in plaintext it gets pasted, committed, logged, or handed to someone.
Your AI agent
Claude Code, Claude Desktop, Cursor and Windsurf call APIs through the broker. The key is never in the context window, a transcript or the agent's memory. One click in the app, or usk mcp install claude-code.
Your own scripts and repos
"Protect a project" moves the real keys out of a folder's .env into the vault and leaves handles behind. Commit it, screenshot it, paste it: nothing happens. Caps and canaries catch what slips through.
The developer you hire
Grant a freelancer or agency the use of a key with rules, an expiry and a signed log, through a broker they don't control. Revoke in one click. Join the waitlist.
What a handle can do
Each handle carries its own rules, explained in plain English and enforced before anything leaves your machine.
Paste and done
A key's shape tells Unseenkey which of 65 providers it belongs to. Allowed websites fill in, and one read-only request checks that it works.
Rules per handle
Presets per provider: stripe:payments takes payments and refuses refunds and payouts. Paths, methods, time windows, expiry, approvals.
Hard caps
--cap 500/day: the 501st request is refused before it leaves the machine. Projects get a daily limit across all their keys.
Canaries
--canary makes a handle that never works. Plant it in .env.example; any use means someone has your files, and the vault locks.
Live approvals
Sensitive calls wait for you: allow once, always allow, or don't allow. Confirmed with Windows Hello or your password.
Projects
Keys grouped by the app that uses them. AI tools working in a project's folder see only that project's keys.
Incident responses
A burst of refused requests throttles, pauses, asks you, or locks the vault. Your choice per handle; one click to resume.
Camouflage handles
Handles shaped like the provider's own keys (sk-proj-usk-…) for SDKs that check formats. Every format carries the usk marker.
AWS and OAuth2
boto3, the AWS CLI and the JS SDK sign with a placeholder; the broker re-signs with the real key. Refresh tokens stay in the vault.
Tamper-evident log
Every call, allowed or refused, written before the response returns. A hash chain plus a keyed head catches edits, gaps and deleted entries.
Activity in plain words
"Claude Code used openai · OK". Grouped by day, with filters and search. Click any entry for the technical record.
Desktop app
Projects, keys, agent access, approvals and activity. Windows Hello, locks when idle (5 minutes to 4 hours), on sleep and screen lock. Signed auto-updates.
Why not just…
Most people already handle keys one of these ways. Here is what each one leaves open.
A .env file |
A secrets managerDoppler, Infisical, 1Password CLI, Vault | Your own proxy | Unseenkey | |
|---|---|---|---|---|
| Your AI tool never sees the real key | No | No, it is injected into the process | Yes | Yes |
| Works offline, no account | Yes | Usually needs an account or a server | Yes | Yes |
| Rules per call: host, path, method | No | No | If you build them | Yes, presets for 65 providers |
| Asks you before risky calls | No | At most for reading a secret, not per call | If you build it | Yes, confirmed with Windows Hello |
| Removes the key from responses | No | No | If you build it | Yes, streamed and compressed too |
| Spending limits | No | No | If you build them | Per handle and per project |
| Tamper-evident log of every call | No | Logs secret reads, not API calls | If you build it | Yes |
| AWS signing and OAuth refresh | The key sits in the file | The key reaches the SDK | If you build them | Done inside the broker |
Already use a vault? Keep it.
A vault stores keys; Unseenkey stops them reaching the agent. They work together. Importers for 1Password, Bitwarden and the OS keychain are on the roadmap.
Built your own proxy?
So have others: Infisical Agent Vault, fnox and OneCLI share the core idea, which tells us the problem is real. Unseenkey focuses on the person who owns the key: a desktop app with approvals, AWS re-signing, OAuth refresh, canary keys, a log that catches deleted entries, and next, lending a key to someone you hire.
Which one would leak?
Paste a key or a handle. This runs in your browser; nothing is sent anywhere, and this page has no analytics. Still: don't paste your real keys into web pages, use the samples.
What a policy says
Every preset renders to plain English, exactly what usk policy explain prints. Pick a provider and a policy.
Security, and what it does not do
Everything here is in the open: the code, the threat model and the disclosure policy.
Encrypted vault
Argon2id (256 MiB) and XChaCha20-Poly1305. Keys locked in memory and wiped on lock. A 24-word recovery phrase; no escrow, no support-desk recovery.
Owner confirmation
Revealing a key, approving a request or widening access needs your password or Windows Hello, not just a token any program could read.
Fail closed
Each key is locked to its provider's hosts. Browser-origin requests, unmatched requests and anything the broker cannot classify are refused.
Scrubbing
The real key is removed from responses, including gzip, brotli and deflate replies, and from logs and error messages. A handle never reaches the provider.
Erased, not just deleted
Replacing or deleting a key purges every old version from the vault file, so an old copy of the file cannot give it back.
Signed releases
Every archive has a Sigstore signature and an SBOM; desktop updates are signed. Every CI action is pinned to an exact commit.
What it does not do. It is alpha software and not yet externally audited, so use it with keys you can rotate. It stops accidental leaks and limits what misuse can do. A program running as you on an unlocked machine can still use keys within the rules, but it cannot take the key away or approve its own requests. It is not a sandbox; for a hostile agent you also want one.
Install
Free and open source. No account, no telemetry, nothing leaves your machine.
# Windows scoop bucket add unseenkey https://github.com/Bhagyesh97/scoop-unseenkey scoop install usk # macOS and Linux brew install Bhagyesh97/unseenkey/usk # from source (Rust 1.85+) cargo install --locked --git https://github.com/Bhagyesh97/unseenkey usk
Installers for Windows (MSI, EXE), macOS (DMG) and Linux (deb, rpm, AppImage), and CLI archives for every platform. The installers are not yet code-signed, so Windows SmartScreen and macOS Gatekeeper warn on first launch.
Six releases in nine days
Built in the open since 30 September. Full changelog.
- 0.1.5Security fixes from a full code review: owner confirmation, compressed replies scrubbed, old values erased.
- 0.1.465 providers, keys recognised and tested on paste, the "how careful" setting, activity in plain words.
- 0.1.3Replace a key without breaking what uses it; a refused key says how to fix it.
- 0.1.2Projects: protect a folder in one step, a daily limit per project.
- 0.1.1The log catches deleted entries, limits survive a restart, the desktop app's design.
- 0.1.0First public release.
Hiring a developer? Never hand over your keys.
Delegation is the next thing we build: a client grants a developer or agency the use of a Stripe, AWS or OpenAI key with rules, an expiry and a signed log, through a broker the developer does not control. If you have handed a key to a contractor, or been handed one, we would like to talk to you before we build it.
Questions
Is it free?
Yes. The local app, the CLI and every feature on this page are free and open source under Apache-2.0. The hosted part that is coming next, for sharing keys with people you hire, will be paid. If Unseenkey is useful to you, sponsoring it on GitHub pays for a first external security audit.
Does it work with my tools?
Claude Code, Claude Desktop, Cursor and Windsurf connect in one click. Any SDK that lets you set its API address works, which covers OpenAI, Anthropic, Stripe, AWS and most others. Tools that cannot change their address can use usk run, which is weaker: that one process sees the key, but its output is scrubbed and logged.
Does it slow requests down?
It adds one hop inside your own machine. Measured on a Windows laptop against a local mock server: 0.4 ms at the median and 1.9 ms at p99.
What if I forget my password?
When you create the vault you get 24 recovery words, shown once. Write them down. There is no other way back in, by design.
Can I use it on servers or in CI?
Not yet. Today it is built for your own machine: development and AI tools.
Why should I trust it with my keys?
Your keys never leave your machine. There is no server, no account and no analytics. The code, the threat model and the release signatures are public. It has not had an external audit yet, so start with keys you can rotate.