vallkey

Send any Python SDK through Vallkey with no code changes.

Vallkey gives you ghost keys: stand-in API keys that only work within your rules, and that you can kill in one click. This package sends every request that carries a ghost key to Vallkey instead of the provider, with the same path, so you do not need to set a base URL in any SDK. Requests without a ghost key are not touched.

pip install vallkey

Then either set an environment variable, with no change to your code:

VALLKEY_AUTO=1 python app.py

or import it once, anywhere in your code:

import vallkey.auto

Put your ghost key where the real key was (for example OPENAI_API_KEY=gk_openai_...) and use the SDK as usual:

from openai import OpenAI

client = OpenAI()  # no base_url needed

It covers httpx and httpx2 (OpenAI, Anthropic and most new SDKs), requests (Stripe, Twilio and most others), aiohttp and urllib. Libraries imported later are covered too, so the order of imports does not matter.

To set up ghost keys from your .env files, use the command line tool: npx vallkey init.

Docs: https://vallkey.com/docs/python/

Web pages and mobile apps (short-lived keys)

Keep the ghost key on your server, and give each signed-in user a short-lived key instead. It expires in minutes and can only do what the ghost key allows.

from vallkey.session import create_session_key  # reads VALLKEY_GHOST_KEY

key = create_session_key(user=user.id, ttl_seconds=900)["session_key"]
# send key to the page or app

See https://vallkey.com/docs/browsers/.