Documentation

Key vault

Add provider API keys from the Key Vault page. Keys are encrypted with AES-256-GCM on the server before storage. We never return plaintext keys after vaulting.

• Free: up to 3 keys across 2 providers
• Pro: up to 25 keys, all 9 providers
• Team: shared team vault with role-based access

Spend sync

Click the sync button on any active key to pull usage from the provider API. Pro and Team plans can run hourly sync via cron (/api/cron/sync with CRON_SECRET).

Anthropic requires an Admin API key for usage reporting. OpenRouter and other providers use their documented billing endpoints where available.

Budgets & alerts

Set monthly limits per provider on the Budgets page. Email alerts fire when spend crosses your threshold (Pro/Team). Free plan includes one budget.

API tokens

Pro and Team subscribers can create personal API tokens under Settings → API & Integrations. Tokens are prefixed with klv1_ and shown once at creation.

Include the token as Authorization: Bearer klv1_… on API routes (e.g. spend export, vault export, spend sync).

Webhooks

Configure an HTTPS endpoint in Settings. Each save generates a signing secret prefixed with whs_. We POST JSON for budget.warning and spend.synced events (Pro/Team).

Verify the X-LLMLocker-Signature header: HMAC-SHA256 of {timestamp}.{body} using your webhook secret. Re-save your webhook URL after upgrading to enable delivery if you configured it before migration 004.

Team workspace

Team plan adds a shared vault, invites, roles (owner, admin, member, viewer), and an audit log. Manage members from the Team page. Invite links expire after 7 days.