2026-07-18
Stop putting OpenAI keys in a shared .env
Why shared provider keys leak, and how virtual keys with budgets fix offboarding and spend.
Every team starts the same way: one sk- key in a shared .env, Slack, or 1Password vault. It works until someone leaves, a repo goes public, or the bill spikes overnight.
Virtual keys flip the model. The real provider key stays in an encrypted vault. Each developer, service, or client gets a kc- key with its own budget, model allowlist, and expiry.
When someone leaves, you revoke one key — not rotate the master for the whole company. When a client project ends, the key expires automatically.
KeyC sits in front of OpenAI and Anthropic as a drop-in base_url. Two lines of SDK change. Hard budgets return HTTP 402 when spend hits the cap.