We Scattered API Keys Everywhere for a Year. Here's What It Cost Us

Eight engineers. A year of non-stop AI development — Claude, GPT, DeepSeek, Gemini, you name it. By the end of that year, I realized we had no idea where our API keys actually were.

Not "we didn't have a plan." I mean literally: we could not produce a complete list.

They were in .env files (some checked into Git before we noticed). In chat histories. In CI/CD secrets (with no rotation policy). In Slack DMs ("hey, what's the Claude key again?"). And — this is the worst one — one key belonging to an engineer who'd left five months ago was still active and quietly draining $180/month.

That's just our story. Let me tell you what happened in the broader ecosystem this year:

• A compromised PyPI package serving 95M monthly installs was stealing API keys for weeks
• One well-known AI platform had its AWS keys breached, exposing Box + Stripe + Cloudflare credentials
• A company burned $500M in Claude credits in a single month because someone forgot to set a spending cap

The problem is structural: token marketplaces and API gateways are laser-focused on making tokens easy to buy. Procurement teams love marketplaces. Developers love the 30-model drop-down. But nobody is building the infrastructure for management.

Who has access? What are they spending? Is that spending even legitimate? Is that departed engineer's key still running?

We got tired of asking these questions and built AiKey to answer them. Three things it does:

1. Encrypted local vault — keys never touch .env or chat
2. Revocable virtual keys with per-person budgets — one click to kill a key
3. Full audit — who spent what, when, on which project

Terminal tool. Terminal workflow. Runs locally. No key ever leaves your machine in plaintext.

For a bootstrapped team like ours, this was the difference between guessing our AI costs at the end of the month and knowing them by project before the bill arrived.

Try it:

macOS/Linux: curl -fsSL https://aikeylabs.com/zh/i/ih06 | sh
Windows(cmd): curl.exe --ssl-no-revoke -fsSLo "%TEMP%\aikey-w.ps1" https://aikeylabs.com/zh/iw/ih06 && powershell -ExecutionPolicy Bypass -File "%TEMP%\aikey-w.ps1"
Windows(PS)：$f="$env:TEMP\aikey-w.ps1"; curl.exe --ssl-no-revoke -fsSLo $f https://aikeylabs.com/zh/iw/ih06; & $f

Enterprise: [email protected]