BYOKEY

Bring Your Own Keys Turn AI subscriptions into standard API endpoints. Expose any provider as OpenAI- or Anthropic-compatible API — locally or in the cloud.

Subscriptions                                     Tools

Claude Pro  ─┐                              ┌──  Amp Code
OpenAI Plus ─┼──  byokey serve  ────────────┼──  Cursor · Windsurf
Copilot     ─┘                              ├──  Factory CLI (Droid)
                                            └──  any OpenAI / Anthropic client

Features

• Multi-format API — OpenAI and Anthropic compatible endpoints; just change the base URL
• OAuth login flows — PKCE, device-code, and auth-code flows handled automatically
• Token persistence — SQLite at ~/.byokey/tokens.db; survives restarts
• API key passthrough — Set raw keys in config to skip OAuth entirely
• Deploy anywhere — Run locally as a CLI, or deploy as a shared AI gateway
• Agent-ready — Native support for Amp Code; Factory CLI (Droid) coming soon
• Hot-reload config — YAML-based with sensible defaults

Supported Providers

Coming soon — auth implemented, executor in progress: Antigravity (Google) · Qwen (Alibaba) · Kimi (Moonshot) · iFlow (Z.ai)

Installation

Homebrew (macOS / Linux)

brew install AprilNEA/tap/byokey

From crates.io

cargo install byokey

From source

git clone https://github.com/AprilNEA/BYOKEY
cd BYOK
cargo install --path .

Requirements: Rust 1.85+ (edition 2024), a C compiler for SQLite.

Quick Start

# 1. Authenticate (opens browser or shows a device code)
byokey login claude
byokey login codex
byokey login copilot

# 2. Start the proxy
byokey serve

# 3. Point your tool at it
export OPENAI_BASE_URL=http://localhost:8018/v1
export OPENAI_API_KEY=any          # byokey ignores the key value

For Amp:

// ~/.config/amp/settings.json
{
  "amp.url": "http://localhost:8018/amp"
}

CLI Reference

byokey <COMMAND>

Commands:
  serve         Start the proxy server (foreground)
  start         Start the proxy server in the background
  stop          Stop the background proxy server
  restart       Restart the background proxy server
  autostart     Manage auto-start on system boot
  login         Authenticate with a provider
  logout        Remove stored credentials for a provider
  status        Show authentication status for all providers
  accounts      List all accounts for a provider
  switch        Switch the active account for a provider
  amp           Amp-related utilities
  openapi       Export the OpenAPI specification as JSON
  completions   Generate shell completions
  help          Print help

byokey serve

Options:
  -c, --config <FILE>   Config file (JSON or YAML) [default: ~/.config/byokey/settings.json]
  -p, --port <PORT>     Listen port     [default: 8018]
      --host <HOST>     Listen address  [default: 127.0.0.1]
      --db <PATH>       SQLite DB path  [default: ~/.byokey/tokens.db]

byokey start — Same options as serve, plus --log-file (default: ~/.byokey/server.log).

byokey login <PROVIDER>

Runs the appropriate OAuth flow for the given provider. Supported names: claude, codex, copilot, gemini, kiro, antigravity, qwen, kimi, iflow.

Options:
      --db <PATH>   SQLite DB path [default: ~/.byokey/tokens.db]

byokey logout <PROVIDER> — Deletes the stored token for the given provider.

byokey status — Prints authentication status for every known provider.

byokey accounts <PROVIDER> — Lists all accounts for a provider.

byokey switch <PROVIDER> — Switches the active account for a provider.

byokey autostart <enable|disable|status> — Manages boot-time service registration.

byokey amp <inject|disable-ads> — Amp utilities: inject proxy URL into Amp config, or patch Amp to hide ads.

Configuration

Create a config file (JSON or YAML, e.g. ~/.config/byokey/settings.json) and pass it with --config:

port: 8018
host: 127.0.0.1

providers:
  # Use a raw API key (takes precedence over OAuth)
  claude:
    api_key: "sk-ant-..."

  # Disable a provider entirely
  gemini:
    enabled: false

  # OAuth-only (no api_key) — use `byokey login codex` first
  codex:
    enabled: true

All fields are optional; unspecified providers are enabled by default and use the OAuth token stored in the database.

Contributing

See CONTRIBUTING.md for build commands, architecture details, and coding guidelines.

License

Licensed under either of MIT or Apache-2.0 at your option.