Users bring keys.You never hold them.
With Fiducy, your app uses your users' AI keys without ever storing or seeing them. Their keys, none of the risk.
bun add @fiducy/sdk @fiducy/farm- Works with
- OpenAIAnthropicGeminiOpenRouter
- Runs on
- AWSNitro
- Works with
- OpenAI
- Anthropic
- Gemini
- OpenRouter
- Runs on
- AWSNitro
A breach can't leak what you never stored
Your app keeps a handle, not a key. The real key exists for one request inside a sealed enclave, then it is gone.
Ship bring-your-own-key this week
No crypto to write and no key vault to run. Four small pieces drop into the app you already have, and your model calls look the same as before.
src/lib/fiducy.ts
import { getStorage } from '@farm.js/core/storage';
import { createFiducy, keyValueStorage } from '@fiducy/sdk/server';
import { auth } from '@/lib/auth';
const { FIDUCY_GATEWAY_URL, FIDUCY_APP_SECRET } = process.env;
if (!FIDUCY_GATEWAY_URL || !FIDUCY_APP_SECRET) throw new Error('Set the Fiducy env vars');
export async function getUserID(request: Request) {
const session = await auth.api.getSession({ headers: request.headers });
return session?.user.id ?? null;
}
export const fiducyServer = createFiducy({
gatewayURL: FIDUCY_GATEWAY_URL,
appSecret: FIDUCY_APP_SECRET,
storage: keyValueStorage(getStorage('fiducy')),
getUserID
});When something leaks, your users' keys don't
Users don't have to take your word for it. GET /attestation proves which code holds their key, signed by AWS. How to check it
Your database
If your database leaks, attackers get handles that open nothing.
Each handle needs the enclave and your app secret before it opens anything.
Your server logs
If your logs leak, there is no key in them to find.
Keys go from the widget straight to the enclave and never pass your server.
Fiducy's storage
If Fiducy is breached, attackers get half a key. Useless alone.
The other half lives only in your handle. Neither half opens anything alone.
An AWS admin
Even an AWS admin cannot decrypt your users' keys.
KMS unwraps only for the attested enclave image, and nothing is stored open.
Questions
Before you hand over your users' keys.
Something else on your mind? The docs are searchable, and so is llms.txt.
Self-host
Free and open source
Keep every key in your own AWS account. One CloudFormation stack, and nothing leaves your infrastructure.
Self-hosting guideManaged
Coming soon
Skip the infrastructure. We run the enclave and the dashboard, you add the SDK. Leave your email and you hear first.