Spend alerts and switch-off for AI API keys
Stop stolen AI keys before they run up your bill.
Keyfuse watches the spend on each AI API key. When one spikes, it switches that key off and helps you replace it.
You're on the list. We'll email you when it's ready to try.
Switched off, 1 key
In Zeabur breach, rotate
Keys leak through platforms you trust.
When a developer platform leaks keys, the feed lists it immediately, with what to rotate.
See which paid keys your agents can reach.
Claude Code, Cursor, Codex and MCP servers can read most of your disk, and so can anything that hijacks them.
- Env files and configs.env, .envrc, .npmrc and more
- MCP and agent configsCursor, Claude Code, Claude Desktop, Codex
- Shell profiles and historyOld export lines and pasted commands
- Your live environmentVariables every agent you start can read
Runs on your machine. Sends nothing. Never prints a full key.
When one key spikes, only that key is switched off.
Provider budgets alert on the account total, often after the money is spent. Keyfuse compares each key to its own usual spend.
Find
Finds every key agents reach.
Watch
Learns each key's usual spend.
Switch off
Turns off only that key.
Each key shows whether its provider supports switch-off. Guided rotation puts the new key in place first and revokes the old key last.
Keep real keys out of your agents.
Both are in the Team plan.
Runtime secret broker
Agents request a key when they need it and get a short-lived token, or a single command run with the key set. The real key never enters their context.
Agent policies
Set which agent can use which key, for how long and up to what spend. Every request is logged.
Priced per key, not per seat.
Start free. Pay when you want each key watched.
| Compare plans | Free For checking your own machine. $0 Open source, coming soon |
Solo Early access For one developer paying for AI APIs. $15/mo Up to 5 keys |
Team For teams whose agents spend real money. $79/mo Up to 50 keys, 10 members |
Enterprise For security and compliance needs. Custom Unlimited keys |
|---|---|---|---|---|
| On your machine | ||||
| Open-source key checker | ||||
| CI check on pull requests | ||||
| Public breach feed | ||||
| Watching each key | ||||
| Spend checks | Every 5 min | Every minute | Every minute | |
| Per-key spike alerts | Email and Slack | Email and Slack | ||
| Switch-off where supported | ||||
| Alerts when your keys are in a breach | ||||
| History | 30 days | 1 year of audit logs | Custom retention and DPA | |
| For teams | ||||
| Guided rotation | ||||
| Runtime secret broker | Self-hosted or on-prem | |||
| Agent policies | ||||
| Evidence pack for billing disputes | ||||
| SSO (SAML) and SCIM | ||||
| Get early access | Get early access | Get early access | hello@keyfuse.dev | |
No card needed. You pay nothing until you choose a plan.
Does the checker send my keys anywhere?
No. It runs offline and makes no network requests. It shows only the prefix and last 4 characters, like sk-ant-api03-****s2Pq.
Which providers does it detect?
By key format: OpenAI, Anthropic, Google Gemini, OpenRouter, xAI, Groq, Hugging Face, Replicate and Perplexity. By variable name: Mistral, Cohere, DeepSeek, Together and Fireworks.
Why not just use provider budgets?
Use them too. Budgets cover the whole account. A stolen key can burn the full budget before the alert reaches you, and the alert won't say which key.
How does the hosted service see my usage?
Through each provider's usage or admin API, with read access where the provider offers it. Switch-off needs more access, so it stays opt-in per key.
What does early access mean?
Early access is open. Sign up below and we'll email you as soon as you can try it. No card needed.