Getting Started with BYOK API

BYOK API (Bring Your Own Key) is a wallet for your AI keys. Think of it like MetaMask, but instead of crypto keys and transactions, it holds AI API keys and routes inference requests.

MetaMask stores crypto keys → dApps request transactions → you approve → blockchain executes
BYOK API stores AI keys → apps request capabilities → you approve → providers execute inference

The bridge is your personal AI wallet that runs in the browser. Apps never see your keys — they just get results.

How it works

The Bridge (your wallet) runs on a separate origin (e.g., bridge.byokapi.com) and stores your API keys in the browser's IndexedDB — just like a crypto wallet stores private keys.
Consumer apps embed a hidden iframe pointing to the bridge. Communication happens via postMessage RPC using kkrpc — like a dApp communicating with MetaMask via window.ethereum.
Grants control what each app can do. Users approve or deny access through a consent popup — like approving a transaction, but for AI capabilities (chat, image, TTS, STT).

The trust problem

Today, AI-powered apps create a two-sided trust problem:

Users don't trust developers — "If I give this app my OpenAI key, what stops them from burning through my quota or leaking it?" Pasting an API key into a random web app is like handing your credit card to a stranger. Even well-intentioned developers can have XSS vulnerabilities that expose keys.

Developers don't trust users — "If I use my own API key for all users, one bad actor could exhaust my entire budget." A single malicious user generating thousands of requests can bankrupt an indie developer overnight. Rate limiting helps, but it's an arms race.

BYOK eliminates both sides:

Problem	Traditional approach	BYOK API
User fears key theft	"Trust me, I'll keep it safe"	Key never leaves your browser. The app only gets inference results, never the key itself.
User fears quota abuse	Hope the developer is honest	You set usage limits per grant. You see every request in your wallet dashboard.
Dev fears cost overrun	Pay for all users, add rate limits	Each user pays their own provider directly. Developer's cost is zero.
Dev fears malicious users	Build abuse detection, spend on infra	Users bring their own keys — there's nothing for them to abuse on your side.

The result: zero-trust AI access. Users control their own API tokens — they decide how much to spend, which provider to use, and can cut off access at any time. Developers ship AI features without holding any keys, managing any billing, or worrying about runaway costs from malicious users.

Beyond OAuth

BYOK isn't "OAuth for AI" — it's a fundamentally different model:

	OAuth	BYOK API
Keys live on	Server (the provider)	Your browser (the wallet)
Who sees your keys	The app + the auth server	Only your browser
Trust model	Trust the app with a token	App never gets any token — only results
Server required	Yes (auth server)	No — everything runs client-side
Revocation	Provider revokes tokens	You revoke grants locally, instantly
Cost model	Developer pays, marks up	User pays provider directly, no markup

Key concepts

Capabilities — what an app can do: language, image, speech, transcription
Grants — approved access tokens stored in the bridge's IndexedDB
Providers — AI backends: OpenAI, Anthropic, OpenRouter, or local WASM via WebLLM
Transport models — AI SDK v6 LanguageModelV3 implementations that proxy calls through the bridge

Packages

Package	Description
`@byokapi/client`	Consumer SDK — connect to bridge, request grants, get AI SDK providers
`@byokapi/shared`	Zod schemas, types, RPC contracts shared between bridge and client
`@byokapi/wasm`	WebLLM-based local AI model (runs entirely in the browser)
`@byokapi/ui`	Shared UI components and Tailwind theme

Next steps

Quickstart — get up and running in 5 minutes
Architecture — understand the iframe bridge pattern
Grants — learn about the permission system