Crumb is in free private beta, bring your own AI provider key
Log in

Temporary AI API keys with real limits.

Crumb sits in front of your AI provider key and hands out short-lived ck_ keys with their own spend caps and expiry, so a workshop, demo, or agent never touches the real key.

Open dashboard

Workshop key pool

42 active keys · $287.40 of $750.00 used · expires tonight at 6:00 PM

KeyBudgetStatus
ck_team_alphaWorkshop pool$42 / $100Active
ck_lab_group_07Student access$78 / $100Near cap
ck_agent_trialDemo script18k tokensActive
OPENAI_API_KEY=ck_… OPENAI_BASE_URL=https://api.getcrumb.dev/v1

How a key pool works

One provider credential goes in. Many capped keys come out, each tied to a recipient and the pool's limits.

01

Store one provider key

Add an OpenAI, Anthropic, or OpenAI- or Anthropic-compatible key to a workspace. Crumb encrypts it and never shows it again.

02

Create a pool with limits

Set a spend cap, token cap, request count, rate limit, model allowlist, and expiry once. Every key in the pool inherits them.

03

Hand out ck_ keys

Email a key or a reveal link to each recipient. They point a tool at api.getcrumb.dev and start working.

Enforcement runs before the request reaches the provider

Crumb checks every call against the key, pool, and workspace policy, reserves the budget, then forwards it. The strictest limit that applies wins.

  • Spend capEstimated cost is reserved before the call and reconciled against real usage after.
  • Tokens & requestsTotal-token and request-count caps with hourly, daily, weekly, or monthly resets.
  • RatePer-key requests-per-minute, enforced with Redis counters.
  • Models & endpointsAllowlist the models a key may call; only coding endpoints are exposed.
  • ExpiryKeys and whole pools stop working at a set time. Revocation takes effect immediately.
$ curl https://api.getcrumb.dev/v1/chat/completions \
   -H "authorization: Bearer ck_lab_group_07" ...

HTTP/1.1 403 Forbidden
{
  "error": {
    "type": "spend_cap_exceeded",
    "message": "Pool spend cap reached.",
    "reset_at": "2026-06-21T00:00:00Z"
  }
}

Key security and storage

Recipients get a proxy key that only works through Crumb. The real provider key stays on the server.

Upstream key
Encrypted at rest with envelope encryption and never returned to a recipient or shown in the dashboard after it is saved.
Crumb keys
Stored as a hash for verification plus an encrypted copy for authorized reveal. The plaintext is shown once.
Reveal & rotation
Every reveal is written to the audit log. Rotating a key revokes the old secret immediately while usage history follows the logical key.
What owners see
Request metadata, spend, and limit hits by default, not prompts or responses unless a workspace explicitly turns body logging on.

See where the budget is going

Every pool and every key has its own dashboard: spend, tokens, requests, top consumers, recent limit hits, and provider-credential status. Export pool usage to CSV after the event.

$287
spent of $750
1.9M
tokens
42
active keys
Top pools by spend
Workshop pool
$287.40
Agent sandbox
$192.10
Class demo
$74.55

Free during the private beta

You bring your own provider key. Crumb doesn't charge for the usage that runs through it.

What you can do today

Everything you need to run access for an event or a team, with hard limits enforced on the money path.

  • + OpenAI, Anthropic, and OpenAI- or Anthropic-compatible providers (DeepSeek, GLM, …)
  • + Pools with shared spend, token, request, and rate limits
  • + Email keys or send expiring reveal links
  • + Bulk recipient import by CSV
  • + Per-pool and per-key usage dashboards
  • + Rotate, revoke, suspend, and a workspace kill switch

Managed credits and billing are not part of the beta. Crumb stays in the access-control and enforcement lane while it is free.

Stop sharing your real API key for temporary work.

Spin up a pool, set the caps, and hand out keys that expire on their own.

Open dashboard