Is it safe to use your own AI API key in a web app?

In a credit-metered tool, the operator holds the AI account, pays for every request and resells access as credits. In a BYOK tool, you hold the account: the tool is the interface, the prompt engineering and the export layer, while the AI cost is billed directly to you by the provider at their published rates.

That is why BYOK tools can skip signup and credit packs. There is no balance to protect, so there is nothing to gate behind an account.

A provider API key can spend money on your account, within whatever limits you set on it. That is the real risk, and it is a billing risk rather than an identity one.

• It cannot log in to your provider dashboard or change your password.
• It cannot read your payment card details.
• It usually cannot create or delete other keys.
• It can be revoked instantly, which invalidates any copy of it anywhere.

Treat a key like a metered utility credential, not like a password. The correct response to any doubt is to revoke and reissue, which costs you nothing.

For metadata generation, the payload is the asset (or a downscaled preview of it) plus the instructions describing the titles, keywords and platform limits you want back. That payload has to reach the AI provider — no local model is doing the describing. What should not travel with it is anything unrelated: your file library, other filenames, or a copy of your key destined for someone else's storage.

• Your key is saved in your own browser's storage on your own device, alongside your provider and model choice.
• Generation is relayed through a server function, so the key never appears in your browser's network log as an outbound request header to a third-party host.
• The key is used for the duration of the request and is not written to a database or retained server-side afterwards.
• Clearing site data, or the Clear key control in settings, removes it. Nothing has to be deleted on our side because nothing was kept.

1. Open your browser's developer tools, Network tab, and run one small generation. Look at every request the page makes and confirm they go to the tool's own domain or the AI provider's — not to an unrelated analytics or logging host.
2. Check Application, then Local Storage and Session Storage. You should be able to see exactly where the key lives, and delete it yourself.
3. Open your provider's usage dashboard after a batch. The request count and spend should match what you just ran. Unexplained usage between your own sessions is the clearest possible signal to revoke.
4. Read the tool's privacy page for a specific statement about key storage. Vague language about "securely storing your credentials" means the key is stored somewhere on their side.
5. Revoke the key when you are done testing and issue a fresh one. If a tool keeps working after you revoke the key, it cached it somewhere.

• Use a dedicated key per tool, never your main production key.
• Set a spend cap or rate limit on that key where the provider offers one.
• Confirm in the network tab where requests actually go.
• Confirm you can see and delete the stored key yourself.
• Watch provider usage for the first few batches.
• Prefer tools that state plainly that keys are not stored server-side.
• Rotate on any doubt, and delete the key when you stop using the tool.

This checklist is not specific to us. Run it against every BYOK tool you try, including this one.

Can a BYOK tool see my API key?

Any tool you paste a key into can technically read it while it is in use — that is unavoidable, because the key has to reach the AI provider. What matters is where it is stored, whether it is sent anywhere other than the provider, and whether you can revoke it at will.

Where does Metadata World keep my key?

In your browser's local storage on your own device. Generation requests are relayed through a server function so the key is not exposed in browser network logs, and it is not written to a database or kept server-side after the request completes.

What is the safest way to use a provider key in any web tool?

Create a dedicated key for that tool, set a spending or rate limit on it where the provider allows one, watch the provider's usage dashboard for the first few batches, and rotate or delete the key when you stop using the tool.