BYOK Security Checklist for AI Build Tools

Store provider keys in sessionStorage when possible for tab-only scope. Never persist keys to your database, logs, analytics payloads, or crash traces.

The UI must state the real path: keys are forwarded through your /api routes only for user-triggered actions, then sent upstream to providers.

• No automatic key-using requests on page load.
• No model discovery calls on key save unless explicitly user-triggered.
• Clear key controls must fully wipe sessionStorage and in-memory state.

Require a user-provided key for every generation and model refresh route. Remove env-key fallbacks in strict BYOK mode.

if (!apiKey?.trim()) {
  return NextResponse.json(
    { errorCode: "MISSING_API_KEY", message: "API key is required." },
    { status: 400 }
  )
}

Apply per-IP rate limits and clear timeout handling for long generation streams. Emit machine-readable error packets so UI can recover gracefully.

• Return 429 with Retry-After for burst traffic.
• Return structured in-band stream errors for format failures.
• Disable duplicate submits while generation is running.

Avoid absolute claims that can become false after feature changes. Tie copy to explicit actions and verify behavior in DevTools.

• Good: Used only when you click Generate or Refresh models.
• Good: Forwarded via /api for that action and never stored server-side.
• Avoid: Sent only directly to provider (if your backend proxies requests).