⌁
ContextKey SHIELD
Starter workspace
CQ
Chris Quinn
ContextKey Shield

Make your prototype safe to share.

Protect provider credentials with a route your frontend can call safely.

Protection active
Your first protected route
OpenAI · production environment
READY
↗
/api/ai/chatProxy target · api.openai.com/v1/responses
••••••••••••••••••••
https://prototype.qurmmius.app
!
Why this is safeThe key is stored as an edge environment secret. Your client only receives a short-lived response; the raw key never enters the browser bundle.
Drop-in client pattern
Replace direct provider calls with your protected route
// Your browser app — no provider key required
const response = await fetch('/api/ai/chat', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ message })
});

// ContextKey validates origin, rate limit, and schema
const result = await response.json();
Protection at a glance
Last 24 hours · starter workspace
LIVE
128+18% vs prior day
32.3% of traffic
4dRotate in 26d
✓

Request allowed

POST /api/ai/chat · origin verified

!

Request blocked

Unknown origin · rate limit preserved

↻

Secret health check

Provider connection healthy

View full audit log →
Guardrails
Defaults that keep small teams protected
4 / 4 ON
✓
Origin allowlistReject requests from unregistered domains.
✓
Schema validationOnly approved request fields reach the provider.
✓
Rate limitingCap burst traffic before it becomes a bill.
✓
Audit trailKeep a human-readable record of every decision.