API key first aid

Before you copy that key.

KeyGuard notices when a website creates an API key, stops the copy-paste panic, and guides you toward a safer next move.

Zero accountsZero plaintext storagePlain English

O Developer Platform

DocsUsage

DEVELOPER SETTINGS

API keys

Create a secret key for a new application.

Simulated website

Create new secret key

This key will be shown once. Store it somewhere secure.

Name Permissions

KKeyGuard

Interactive draft

New secret detected

Pause before you copy.

This page just created an API key. Don’t paste it into Slack, email, a screenshot, or frontend code.

Let KeyGuard handle it first.We’ll explain what it is and help you export it safely.

TRY IT Select “Create secret key” and watch KeyGuard intervene.

The missed moment

Security tools arrive after the leak. KeyGuard appears when the key does.

Recognize

Identify common providers from the key format, locally.

Explain

Translate account and billing risk into language anyone can act on.

Protect

Offer practical actions instead of another warning to dismiss.

Cloudflare architecture

Built for the edge.
Blind to the secret.

Encryption stays in the browser. Cloudflare delivers the experience and, in the full product, would coordinate one-time access without receiving a plaintext API key.

Implemented in this prototypeNOW

Cloudflare Workers

The edge entry point serves the app and applies strict security and privacy headers.

Workers Static Assets

The browser experience is bundled with Vite and connected through the Worker’s asset binding.

Wrangler

Generates Worker types, validates configuration, and uploads the Worker and Vite-built assets during deployment.

Full backend architectureNEXT

Workers API

Would expose create, claim, and expiration endpoints designed to accept only payloads encrypted by the browser.

Durable Objects

Would route each share ID to one strongly consistent coordinator that atomically permits only its first valid claim.

Workers KV

Would hold expiring, non-authoritative share metadata for global lookup. Its eventual consistency makes it unsuitable for deciding whether a link is unused.

Cloudflare R2

Would store client-encrypted exports or larger ciphertext objects with lifecycle deletion. The application would keep passwords and plaintext in the browser.

Cloudflare Access (Zero Trust)

Would use identity policies and service tokens to protect internal operations, support tools, and administrative endpoints.

Turnstile + Workers Rate Limiting

Would require server-side Siteverify validation and rate-limit create and reveal endpoints to reduce automated abuse.

Cloudflare Secrets Store

Would bind KeyGuard’s operational credentials, such as the Turnstile Siteverify secret, to the Worker. It would never store captured user keys.

Workers Observability

Would use sanitized custom logs and metrics. Sensitive values stay out of URLs and console output, with invocation logs disabled where needed.

01Browser encrypts→02Worker receives ciphertext→03KV indexes expiring metadata→04Durable Object permits one claim→05Browser decrypts