# Byoky > Your AI keys are worth $1000s. Stop pasting them into random apps. One encrypted Chrome wallet for Claude, GPT, Gemini & 12 more Canonical page: [https://chrome-stats.com/d/byoky](https://chrome-stats.com/d/byoky) ## Overview - **ID:** `byoky` - **Platform:** Firefox - **Type:** Firefox add-on - **Status:** Available - **Publisher:** byoky - **Category:** web-development,privacy-security - **Daily users:** 4 - **Version:** 0.9.13 - **Last updated:** 2026-05-08 - **First published:** 2026-03-18 - **Size:** 179 KB - **Data as of:** 2026-09-16 - **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/byoky/) - **Website:** [https://byoky.com](https://byoky.com/) ## Description You've got 15× the room you're using. Chrome Web Store users actually read descriptions (more than App Store), and MV3 reviewers care about clear, specific permission justification. Here's a fleshed-out replacement: Your AI keys are worth $1000s. Stop pasting them into every new extension. byoky (Bring Your Own Key) is an open-source browser wallet that stores your LLM API keys and OAuth tokens in an encrypted local vault. Developers integrate via @byoky/sdk — their apps use your keys without ever seeing them. HOW IT WORKS
  1. Install byoky and set a master password — your vault is encrypted on-device with AES-256-GCM.
  2. Paste your API keys or sign in via OAuth (Anthropic, OpenAI, Google Gemini).
  3. Open any byoky-enabled app — approve access in one click. Your keys stay in the vault.
FEATURES • 15 AI providers — Anthropic, OpenAI, Google Gemini, Mistral, Cohere, xAI (Grok), DeepSeek, Perplexity, Groq, Together AI, Fireworks AI, OpenRouter, Azure OpenAI, and custom endpoints. • Setup tokens — use your Claude Pro or Max subscription, not only pay-per-use API keys. • Apps marketplace — install curated mini-apps that run sandboxed inside the wallet. Your keys stay in the vault. • Token Pool — discover free token gifts shared by the community, or publish your own. • Token gifts — share access with friends or teammates without sharing the key itself. Set budgets, expirations, revoke in one click. • Alias Groups — bucket apps by purpose (Personal, Work, Side Project) and pin each group to a specific key. Drag apps between groups to swap keys on the fly. • Cross-provider routing — drag an app from a Claude group into a GPT group and the wallet transparently translates the request body, response body, and SSE streams. Apps keep calling their preferred SDK; byoky picks the upstream. • Mobile pairing — pair your iPhone or Android wallet via QR code; no extension install required for mobile users. • CLI / desktop support — route OpenClaw or any CLI tool through @byoky/bridge. Your keys never leave the browser. • Backend relay — @byoky/sdk/server lets your server make LLM calls through the user's browser. No secrets on the server. • Full audit log — every request timestamped by app, provider, status. • Spending caps — per-app and per-provider token limits, enforced in the proxy. • Encrypted export/import — back up the vault as a .byoky file. • Local-first — no cloud account, no telemetry, no tracking. SECURITY • AES-256-GCM encryption with PBKDF2 key derivation (600,000 iterations) via Web Crypto API. • Master password never leaves your device. • Keys never leave the extension — apps only receive short-lived session tokens. • Fully open source under MIT license. Audit the code: https://github.com/MichaelLod/byoky ## Rankings - #50,370 — Overall - #233 — wallet ## Permissions and access ### Permissions - `storage` - `sidePanel` - `identity` - `nativeMessaging` - `alarms` - `https://api.anthropic.com/*` - `https://api.openai.com/*` - `https://generativelanguage.googleapis.com/*` - `https://api.mistral.ai/*` - `https://api.cohere.com/*` - `https://api.x.ai/*` - `https://api.deepseek.com/*` - `https://api.perplexity.ai/*` - `https://api.groq.com/*` - `https://api.together.xyz/*` - `https://api.fireworks.ai/*` - `https://openrouter.ai/*` - `https://*.openai.azure.com/*` - `https://console.anthropic.com/v1/oauth/*` - `https://oauth2.googleapis.com/token` ### Content script matches - `` ## Safety - **Risk impact:** Very high risk impact - **Risk likelihood:** Moderate risk likelihood ### Analysis details - Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site. - This extension has low user count. Unpopular extensions may not be stable or safe. > Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing). ## Similar extensions and apps - [Keyquill](https://chrome-stats.com/d/keyquill) — 1 users - [Keyspace](https://chrome-stats.com/d/keyspace) - [Keypher Password Manager](https://chrome-stats.com/d/keypher-password-manager) - [Prompt Armour — AI Privacy Guard](https://chrome-stats.com/d/prompt-armour-ai-privacy-guard) — 1 users - [Locki](https://chrome-stats.com/d/locki) — 2 users, 5.00 / 5 - [AI Paste Guard](https://chrome-stats.com/d/ai-paste-guard) — 1 users - [ChromeClaw - Personal AI Assistant in Browser 🦞](https://chrome-stats.com/d/chromeclaw) — 13 users, 5.00 / 5 - [AI Firewall](https://chrome-stats.com/d/ai-firewall) — 1 users - [Privatiser](https://chrome-stats.com/d/privatiser) — 7 users - [CleanMyPrompt - AI Privacy Firewall](https://chrome-stats.com/d/cleanmyprompt-ai-firewall) - [Paste\_Guard](https://chrome-stats.com/d/paste_guard) - [Sqreen - DLP for AI Tools](https://chrome-stats.com/d/sqreen-dlp-for-ai-tools) --- Source: [Chrome-Stats](https://chrome-stats.com/d/byoky)