◎

Tokenokio · Trust

Why it’s safe to add your keys

You don’t know us yet, and you’re about to paste real API keys. Here is exactly what happens to them and to your work — no marketing, just the mechanics, and how to verify each claim yourself.

The whole thing, in five lines

  • • Your keys are never stored — not in a database, not on disk, not in logs.
  • • We hold zero float: your provider bills you directly; we never hold a key, a credit, or a cent.
  • • Your prompts, answers and history stay on your device. We can’t read them.
  • • A daily spend cap means a run can never surprise you.
  • • You can verify all of it — the network tab, and the source — in minutes.

1. Where your key actually goes

Your key is saved in your browser’s local storage — on your machine, not ours. When you run a prompt, the key is sent over HTTPS to our server, held in memory for that single call, used to call the provider (Anthropic, OpenAI, DeepSeek, or OpenRouter for other models), and then discarded. It is never written to a database, to disk, or to a log line. The provider adapters are server-only and stateless; there is no “keys” table because there is no place a key is kept.

Being straight about the one nuance: the key does pass through our server for the moment of the call — that’s how any hosted app avoids browser CORS limits — but it is used once and dropped. If even that is more than you want, the local shim proxies calls entirely on your own machine and nothing transits us at all.

2. Zero float — we never touch the money

Tokenokio is not a reseller. We don’t buy tokens, hold provider credits, or take custody of your payments. You bring your own keys; your provider bills your own account. Our only incentive is to route your work to the cheapest capable model — because saving you money is the entire product.

3. Your prompts and results are yours

Prompts, model outputs and your routing history live in your browser. We store a content-free signal only (task type, token counts, which model, cost, latency) and only locally — never the text of a prompt or an answer. That’s the minimum needed to learn which model is best for your work, and it never leaves your device unless you explicitly export or back it up. Full detail: Privacy Policy.

4. It can’t run up a bill

Every prompt page has a daily spend cap. Before any call runs, Tokenokio estimates its cost and blocks it if it would take you past your cap. You set the number; it defaults to a safe low value. A multi-step task is checked against the whole plan’s estimate before the first step fires.

5. Don’t trust us — verify

  • • Watch the network tab. A run makes one request to /api/prompt; the response carries the model’s answer. There is no analytics or third-party call carrying your key.
  • • Use a scoped key. Create a fresh key with a low provider-side spend limit for your first runs, and rotate it after if you like.
  • • Read the code. The provider adapters and the “used once, never stored” handling are in the open — see the security notes in the FAQ.
  • • Start with the shim if you want zero data leaving your machine at all.

Questions?

Ask anything before you paste a key: support@tokenok.io. Also see Privacy, Terms and Cookie Policy.