Vallkey

Changelog

What is new in Vallkey

Features, improvements and fixes, as they ship.

  1. Keys for websites and mobile apps

    Call APIs straight from a web page or an app, without putting a key in it that anyone could reuse.

    • NewShort-lived keys: your server makes one for each signed-in user. It expires in minutes, can only do what its ghost key allows, and ends when the ghost key is killed or rotated.
    • NewAllowed websites: list the websites whose pages may use a key. Pages on other websites are refused.
    • SecurityLimits for each visitor and for each user, including a daily AI budget per user, so one person cannot use up a key for everyone.
    • NewBlock one user in a click from their request in Activity. Their keys stop at once; nobody else is affected.
    • ImprovedActivity shows the website and the user of each request, and can be filtered by both.
    • NewcreateSessionKey in the vallkey npm package and create_session_key in the Python package, plus a step-by-step guide on each key's Connect tab.

  2. Confirm it's you, and emails that look the part

    Dangerous actions now ask for a quick check even when you are signed in, and every email is clearer.

    • SecurityDeleting a key, changing its real key, adding a way to sign in, inviting someone and other dangerous actions ask for a passkey, an authenticator code or an email code. One check covers the next 10 minutes.
    • SecurityEmails with codes say when, where and from which browser they were asked for.
    • ImprovedEvery email has a clear layout, a large code and a button where there is something to do.
    • ImprovedWhen a session ends, you come back to the page you were on after signing in.
    • ImprovedA fuller sidebar with your account, help and today's numbers, and a new menu on phones.

  3. Developer tools

    Protect a whole project in one command, route any SDK through Vallkey without code changes, and let AI agents and CI help.

    • Newnpx vallkey: sign in from the browser, swap the keys in your .env files for ghost keys, and scan code and git history for keys.
    • Newvallkey/auto for Node.js: every SDK goes through Vallkey with no base URL to set.
    • NewThe vallkey Python package: the same for httpx, requests, aiohttp and urllib, with VALLKEY_AUTO=1.
    • NewAn MCP server for Claude Code, Cursor and other AI agents. They protect keys without ever seeing one.
    • NewA GitHub Action that fails the build when a key is committed, and marks it on its line.

  4. Plans for every stage

    A Free plan to start, Pro and Team for production, and Business for companies with security reviews.

    • NewFree, Pro, Team and Business plans, monthly or yearly with 20% off.
    • NewBilling in the dashboard: usage this month, plan changes, invoices and your card.
    • ImprovedBlocked requests never count toward your plan, and paid accounts are never cut off.

  5. Stop a leaked key before you notice

    Keys now learn where they are used, warn you about anything new, and can kill themselves when they look stolen.

    • SecurityLimit a key to your servers' IP addresses or to the countries you choose.
    • SecurityAutomatic kill on a burst of blocked requests, a new country or a traffic spike.
    • SecurityGhost keys and tokens pushed to public GitHub repositories are turned off at once.
    • NewSecurity signals on the overview and each key: new countries, new networks, spikes.
    • NewRotate a ghost key with a grace period, and see when your app stopped using the old one.
    • NewAPI tokens for scripts and CI, each with read, admin or full access.
    • ImprovedEvery request shows its IP address, country, client and provider time.

  6. Sign in your way, and a guided start

    GitHub and email sign-in, a short onboarding for new accounts, and a redesigned settings page.

    • NewContinue with GitHub to sign up or sign in, and connect GitHub from Settings.
    • NewSign in with a one-time code sent to your email.
    • NewOnboarding for new accounts: your name, your stack, a sign-in method and your first key.
    • ImprovedSettings, rebuilt with a section menu and clear sign-in methods.
    • ImprovedSign-up is now two steps: your email and a code.

  7. A new dashboard

    A faster, calmer dashboard with keyboard shortcuts, charts and request details.

    • NewCommand menu and keyboard shortcuts for everything.
    • NewUsage charts for requests, blocks and AI tokens, over 24 hours to 90 days.
    • NewSearch and filter activity, and open any request for its full details.
    • NewKill every key at once in an emergency.
    • ImprovedHighlighted code and a live JSON editor for rules.

  8. Teams, AWS, PayPal and more

    The biggest release yet: team roles, an audit log and five new kinds of protection.

    • NewTeam members with owner, admin and viewer roles, invited by link.
    • NewAudit log of every change, with CSV export.
    • NewAWS request signing, PayPal with OAuth, OpenAI Realtime over WebSockets.
    • NewDaily AI token caps and GraphQL operation rules.
    • SecurityReplace the real key behind a ghost key, with a one-hour safety delay and alerts.

  9. Any API, and twenty services

    Protect keys for any HTTPS API, with built-in support for the most common services.

    • NewCustom API keys: choose the address and how the key is sent.
    • NewBuilt-in support for 18 services across payments, AI, messaging and developer tools.
    • ImprovedLight and dark themes.

Your next leaked key can be a non-event

Protect your first key in five minutes. Free plan, no card needed.

Get startedQuick start guide