Where your key goes

Exactly one place: the provider you picked. This page declares a Content Security Policy whose connect-src lists the 26 provider origins below and nothing else — no analytics host, and not this site's own domain. Your browser blocks any other destination before a request leaves it.

https://ai-gateway.vercel.sh
https://api.cerebras.ai
https://api.cloudflare.com
https://api.cohere.ai
https://api.deepinfra.com
https://api.fireworks.ai
https://api.groq.com
https://api.mistral.ai
https://api.moonshot.ai
https://api.novita.ai
https://api.perplexity.ai
https://api.sambanova.ai
https://api.scaleway.ai
https://api.siliconflow.com
https://api.together.xyz
https://api.tokenfactory.nebius.com
https://api.z.ai
https://dashscope-intl.aliyuncs.com
https://generativelanguage.googleapis.com
https://llm.chutes.ai
https://models.github.ai
https://ollama.com
https://openrouter.ai
https://router.huggingface.co
https://text.pollinations.ai
https://us-south.ml.cloud.ibm.com

The key stays in one JavaScript variable for the length of one request. It is never written to localStorage, a cookie, or the address bar, and a key handed to this page in a query string is discarded and stripped from your history.

This page loads no third-party script of any kind — no analytics beacon, no tag manager, no font or widget host. The only script it runs is the one served from this repository, and the policy above would block anything else even if someone added it.

Read the script that does it.

About this provider

Set your key as and run this instead if the browser cannot reach the provider, or if you would rather not paste a key into a web page at all:

Official sources:

Read on: the full provider catalog how reachability is measured pointing a coding agent at a free tier

Check a free LLM API key in your browser

Check a key

About this provider