Security

How keys are stored

• Keys are validated with the provider, then encrypted with AES-256-GCM (random 96-bit IV per key, authenticated with the record ID) before they are written to storage.
• The encryption key is a server-side secret (a Cloudflare Worker secret). It is never sent to browsers and is not in our source code repository.
• Data is kept in a private database (a Cloudflare Durable Object with SQLite storage) that only the KeyBark server can reach; it has no public endpoint.
• After you add a key we only ever display its last 4 characters.
• Removing a key deletes its encrypted copy.

How keys are used

• Read-only by default. We call the providers' cost/usage endpoints: OpenAI /v1/organization/costs, Anthropic /v1/organizations/cost_report, OpenRouter /api/v1/key or /api/v1/keys/{hash}.
• Kill switch (beta) is opt-in per key. Only if you enable it, confirm it, and name the target key do we call the provider's key-management API (OpenAI: delete a project API key; Anthropic: set a key to inactive; OpenRouter: disable a key). It fires once per arming.
• We never proxy your production traffic and never use your keys to make model requests.

Accounts and the web app

• Passwords are hashed with scrypt. Sessions are signed, HTTP-only, Secure, SameSite cookies.
• All traffic is HTTPS with HSTS. State-changing requests require a same-origin check.
• Sign-up, login and contact forms are rate limited, and accounts lock temporarily after repeated failed logins.
• Payments are handled by Stripe; we never see card numbers.

Use the narrowest key you can

OpenAI and Anthropic cost reports require organization admin keys. Create a dedicated admin key for KeyBark so you can revoke it independently, and remove it from KeyBark if you stop using us.

Report a vulnerability

Please use the contact form with the subject “security”. Don't include live keys.