Introduction
Fiducy is a key custody layer for apps where users bring their own API key (BYOK) for OpenAI, Anthropic, Gemini or OpenRouter.
Your users paste their key into a small iframe served by the Fiducy gateway. The gateway encrypts it inside an AWS Nitro enclave and hands your app a handle. Your server points its AI SDK at the gateway with that handle. The gateway opens the key inside the enclave, calls the provider, and streams the answer back. Your app, your database and your logs never see the plaintext key.
const settings = await fiducy.providerSettings('openai', { userID });
const openai = createOpenAI(settings); // calls go through the gatewayWhy
Storing user API keys yourself means one database leak or one bad log line exposes every key you hold. With Fiducy:
- A stolen database only yields handles and ciphertext. Neither opens a key without the enclave.
- The enclave only runs an image whose hash (PCR0) you can verify, and the KMS key that unwraps keys refuses every other caller, including the AWS account owner.
- Users can revoke a key at any time, and you get per-key monthly limits for free.
How you add it
Fiducy fits into your app as four pieces: a server instance, a route handler, a React component, and a storage adapter you choose.
| Piece | What it does |
|---|---|
createFiducy() | Server instance: route handler, providerSettings, list, save, revoke |
fiducy() for Farm.js | Mounts the handler at /api/fiducy/* as a Farm integration |
<ConnectKeyWidget /> | Drops the gateway iframe into your page and saves the handle |
useFiducyKeys() | Lists and revokes the signed-in user's keys |
Start with the Quickstart.
Open source and managed
The whole stack is open source under the Apache-2.0 license. Self-hosting is free: you run the gateway enclave, KMS key and storage in your own AWS account. The managed service runs the enclave, KMS and dashboard for you.
Let users bring their own AI keys without your app ever holding them.