Keys in plain text
A leaked database should not mean leaked API keys.
Security
Controls you can see, keys we cannot read
Your API keys are shown once and stored only as a hash. Every request is tied to a verified credential, limited by your rate settings and recorded in your history.
Hashed keys
never stored in readable form
Verified identity
taken from the credential, never the body
Full history
every request on record
The problem
What is slowing you down today
No idea who called what
Shared keys and no history make incidents impossible to investigate.
Runaway scripts
One bad loop can burn a month of budget before anyone notices.
Capabilities
Everything you need, nothing you don't
Show-once keys
A key is displayed once at creation. We store only its hash, so it cannot be read back by anyone.
Named, revocable keys
Create a key per integration and revoke any one without affecting the others.
Identity from the credential
The account is taken from the verified key or console session, never from the request body.
Rate limits
A requests-per-minute ceiling per account, adjustable in settings.
Request history
Model, tokens, latency, price, status and a short preview recorded for every call.
You control the inputs
Only what you put in a prompt is processed, so you decide what data leaves your systems.
Use cases
What teams run on it
01
Key hygiene
One key per service, rotated on your schedule.
02
Incident response
Revoke a key and review its history in minutes.
03
Spend protection
Rate limits stop runaway jobs early.
04
Internal audits
A clear record of who used what and when.
How it works
From sign-up to production
- 1
Create named keys
One per environment or service.
- 2
Set your rate limit
Choose a ceiling in settings.
- 3
Review history
Audit every call whenever you need to.
Control
Built so you stay in charge
Keys you control
API keys are shown once at creation and stored only as a hash. Revoke any key instantly from Settings.
Spend you can see
Every request carries its own receipt: tokens in, tokens out, latency and price. Nothing is billed that you cannot trace.
Limits you set
Per-account rate limits and a free monthly allowance keep experiments safe before they become production.
Data you decide on
You choose exactly what you send. Repeat prompts can be served from your cache, and cache hits are never billed.
For developers
One endpoint. Every model.
Send a prompt and a capability, or name a model. One bearer key, one small JSON body, and a full receipt on every response.
curl https://YOUR-DOMAIN/api/ainf/inference \
-H "Authorization: Bearer $AI_INFERENCE_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: order-1042" \
-d '{"prompt":"Summarise this ticket in one line","capability":"chat"}'Questions, answered
Can you recover a lost key?
No. We store only a hash. Create a new key and revoke the old one.
What do you store about requests?
Model, token counts, latency, price, cache status and a short preview of the prompt and response for your history.
Do you make compliance claims?
No. You control what you send, and you should review your own regulatory obligations before sending sensitive data.
How do I report a security issue?
Contact our team through the contact page.
Secure by default, visible by design
Create your first hashed key in seconds.