Leaked API keys, made harmless.
Vallkey gives your apps stand-in keys that only work within your rules. Cap spending, limit models and endpoints, see every request, and kill any key everywhere in one click. Your real keys never touch your code.
Checkout
Stripe · $50 per payment · $500 a day
Allowed today
312
Blocked
9
Spent
$1,284
/v1/charges/v1/payment_intents$9,000.00 is over the $50.00 limit
/v1/payment_intents/v1/refundsnot allowed for this key
/v1/customers/cus_Q8x/v1/payment_intentsWorks with the APIs you already use, and any other HTTPS API · See all integrations
The problem
API keys leak. Usually by accident, always at the worst time
A secret key is all-powerful and lives in a lot of places. It only has to escape from one of them.
Committed to a repository
One forgotten .env file in a commit, a fork, or a public gist.
Shipped to browsers
Bundled into a frontend or mobile app, where anyone can read it.
Printed in logs
Echoed by a CI job, an error tracker or a debug line left in production.
Copied to people and tools
Shared in chat, pasted into a no-code tool, kept on an old laptop.
Rotating a leaked key means finding every place it lives, redeploying, and hoping nothing broke. With Vallkey, the key that leaks was never the real one.
How it works
Every request is checked before your real key is used
Your app calls Vallkey with a ghost key. Vallkey checks the request against that key's rules, then forwards it with the real key, or stops it.
/v1/payment_intents· $24.00Your app
ghost key
Vallkey
checks the rules
Stripe
real key
01
Your app
Calls the API as usual, with a ghost key and Vallkey's address.
02
Vallkey checks
Endpoint, amount, model, rate, expiry and kill state. Anything unclear is refused.
03
The provider
Receives the request with your real key and answers your app through us.
One line of code
Swap the key, keep everything else
Point your SDK at Vallkey and give it the ghost key. Paths, parameters and responses stay exactly the same, so there is nothing to rewrite.
Before: the real key lives in your app
# Anyone who reads this file can spend your moneySTRIPE_SECRET_KEY=sk_live_51Mx9… # A leak means rotating keys, redeploying, and hopingAfter: a ghost key that only works within its rules
# Useless outside its rules, and killable in one clickSTRIPE_GHOST_KEY=gk_stripe_9Qm2… # A leak means one click, and it is overProduct
Everything a key should have had from the start
Rules that the provider never gave you, applied to every request before it leaves our network.
Rules per key
Allow only the endpoints a key needs, limit requests per minute and per day, and set an expiry date.
Spending caps
Per payment and per day, per currency, for Stripe and PayPal.
AI token caps
Allowed models and a daily token budget, streaming included.
One-click kill switch
A killed key stops working everywhere, instantly. Or stop every key at once.
Slow loosening
Stricter rules apply at once. Looser rules, revivals and real-key swaps wait an hour, with an alert.
Activity and audit log
Every request with its outcome, up to 90 days back and exportable. Every change to keys and the team, with who made it.
Alerts where you work
Blocked requests, kills, rule changes and new team members, by email and Slack.
VVallkeynow
key Checkout: POST /v1/payouts was blocked: not allowed for this key
Teams and roles
Owners, admins and viewers, each with their own passkey. Anyone can pull the kill switch.
GraphQL, WebSockets, OAuth
Block mutations, check realtime sessions, and handle PayPal tokens without exposing secrets.
AWS request signing
Your SDK signs with the ghost key; Vallkey signs again with the real credentials.
Use cases
Built for the keys that cost the most when they leak
Payments, AI and cloud credentials, and any other API your product depends on.
Cap every payment, block every surprise
- Largest single payment and a daily total, per currency
- Refunds, payouts and transfers off until you allow them
- Payments to other accounts blocked by default
1import Stripe from 'stripe';2 3// Works only within its rules: $50 a payment, $500 a day.4const stripe = new Stripe(process.env.STRIPE_GHOST_KEY, {5 host: 'api.vallkey.com',6});7 8await stripe.paymentIntents.create({ amount: 2400, currency: 'usd' });Security
Built so that nobody can read your keys, including us
Every real key is sealed with its own encryption key the moment it arrives. Nothing in the product can show it again.
Envelope encryption
AES-256-GCM per key, wrapped by master keys that live only in runtime secrets, and bound to your account.
Passkey sign-in
Face ID, Touch ID, Windows Hello or a security key, per person. Nothing to phish.
Delayed loosening
Anything that opens a key up waits an hour and alerts everyone, so a stolen session cannot act quietly.
Fail closed
Requests that cannot be checked with certainty, such as unknown amounts or odd paths, are refused.
Your data, your region
Keep your account's data in the European Union, or store it globally close to you. Chosen when you sign up.
Your real key
sk_live_51Mx9…Arrives over TLS, then is never stored as-is
Sealed with a data key
AES-256-GCMA fresh key for every ghost key
Data key wrapped
Master key, version 1Lives only in runtime secrets; rotatable
Stored
ciphertext onlyBound to your account and this key
By design
- While a request is forwarded, the real key is decrypted in memory for that moment only, and never written anywhere.
- Vallkey fails closed: if it cannot be reached, requests stop rather than go through unchecked. The docs show how to keep a backup key ready.
Why Vallkey
A leak, with and without Vallkey
The same mistake, two very different afternoons.
What it can do
Real key · Everything your account can do
Ghost key · Only what its rules allow
Spending
Real key · Unlimited until you notice
Ghost key · Capped per payment and per day
How you find out
Real key · A bill, or a customer
Ghost key · An alert the moment it is misused
Stopping it
Real key · Rotate, redeploy, hope
Ghost key · One click, everywhere
Your app
Real key · Breaks until redeployed
Ghost key · Keeps working with a new ghost key
Afterwards
Real key · Guessing what happened
Ghost key · Every request in the activity log
Pricing
Start free. Pay when it protects something real.
Every plan stops a leaked key from costing you money. Paid plans add address limits, automatic kill, rotation and a team.
Free
$0per month
For side projects and trying Vallkey out.
Start for free- 3 ghost keys
- 25,000 requests a month
- Rules, spending caps and kill switch
- Email alerts
- Leak scanning on GitHub
Pro
Recommended$15per month$180 billed yearly
For a product in production.
Start with Pro- 25 ghost keys
- 1 million requests a month
- IP and country limits
- Automatic kill and security signals
- Rotation with a grace period
- Slack alerts and 3 API tokens
Team
$65per month$780 billed yearly
For teams that share keys and need a trail.
Start with Team- 100 ghost keys
- 10 million requests a month
- 10 members, $10 for each extra
- 90 days of activity
- A year of audit log
- 25 API tokens
Business
Let's talk
For companies with security reviews.
Contact us- Unlimited keys and requests
- Unlimited members
- Help with your security review
- Uptime promise (SLA)
- Data processing agreement
- Pay by invoice
Prices in US dollars. Sales tax or VAT is added at checkout where it applies. Paid accounts are never cut off for going over their requests.
FAQ
Questions, answered
Anything else? The docs go deeper, and we read every email.
Your next leaked key can be a non-event
Protect your first key in five minutes. Free plan, no card needed.