Subscriptions                                     Tools

Claude Pro  ─┐                              ┌──  Amp Code
OpenAI Plus ─┼──  byokey serve  ────────────┼──  Cursor · Windsurf
Copilot     ─┘                              ├──  Factory CLI (Droid)
                                            └──  any OpenAI / Anthropic client

• Multi-format API — OpenAI and Anthropic compatible endpoints; just change the base URL
• OAuth login flows — PKCE, device-code, and auth-code flows handled automatically
• Token persistence — SQLite at ~/.byokey/tokens.db; survives restarts
• API key passthrough — Set raw keys in config to skip OAuth entirely
• Deploy anywhere — Run locally as a CLI, or deploy as a shared AI gateway
• Agent-ready — Native support for Amp Code; Factory CLI (Droid) coming soon
• Hot-reload config — YAML-based with sensible defaults

Claude PKCE opus-4-6 · sonnet-4-5 · haiku-4-5

Codex PKCE o4-mini · o3

Copilot Device code gpt-5.x · claude-sonnet-4.x · gemini-3.x

Gemini PKCE 2.0-flash · 1.5-pro · 1.5-flash

Kiro Device code kiro-default

Coming soon — auth implemented, executor in progress:
Antigravity (Google) · Qwen (Alibaba) · Kimi (Moonshot) · iFlow (Z.ai)

Homebrew (macOS / Linux)

brew install AprilNEA/tap/byokey

From crates.io

cargo install byokey

From source

git clone https://github.com/AprilNEA/BYOKEY
cd BYOK
cargo install --path .

Requirements: Rust 1.85+ (edition 2024), a C compiler for SQLite.

# 1. Authenticate (opens browser or shows a device code)
byokey login claude
byokey login codex
byokey login copilot

# 2. Start the proxy
byokey serve

# 3. Point your tool at it
export OPENAI_BASE_URL=http://localhost:8018/v1
export OPENAI_API_KEY=any          # byokey ignores the key value

For Amp:

// ~/.amp/settings.json
{
  "amp.url": "http://localhost:8018/amp"
}

byokey <COMMAND>

Commands:
  serve         Start the proxy server (foreground)
  start         Start the proxy server in the background
  stop          Stop the background proxy server
  restart       Restart the background proxy server
  autostart     Manage auto-start on system boot
  login         Authenticate with a provider
  logout        Remove stored credentials for a provider
  status        Show authentication status for all providers
  accounts      List all accounts for a provider
  switch        Switch the active account for a provider
  amp           Amp-related utilities
  openapi       Export the OpenAPI specification as JSON
  completions   Generate shell completions
  help          Print help

Options:
  -c, --config <FILE>   Config file (JSON or YAML) [default: ~/.config/byokey/settings.json]
  -p, --port <PORT>     Listen port     [default: 8018]
      --host <HOST>     Listen address  [default: 127.0.0.1]
      --db <PATH>       SQLite DB path  [default: ~/.byokey/tokens.db]

Options:
      --db <PATH>   SQLite DB path [default: ~/.byokey/tokens.db]

Create a config file (JSON or YAML, e.g. ~/.config/byokey/settings.json) and pass it with --config:

port: 8018
host: 127.0.0.1

providers:
  # Use a raw API key (takes precedence over OAuth)
  claude:
    api_key: "sk-ant-..."

  # Disable a provider entirely
  gemini:
    enabled: false

  # OAuth-only (no api_key) — use `byokey login codex` first
  codex:
    enabled: true

All fields are optional; unspecified providers are enabled by default and use the OAuth token stored in the database.

See CONTRIBUTING.md for build commands, architecture details, and coding guidelines.

Licensed under either of MIT or Apache-2.0 at your option.