Bring Your Own Key: Building an AI Portal That Never Touches the Billing

#privacy #php #opensource #webdev

Bring-your-own-key, not another subscription

Every few months another "all AI models in one place" product shows up, and almost all of them work the same way: you pay them a subscription, and they resell access to Claude, GPT-4, Gemini and friends at a markup. That's a reasonable business, but it's not the only way to build this, and it's not the way ai.findnix.eu works.

AI Hub is a bring-your-own-key portal: you paste in your own Anthropic, OpenAI, Google, Mistral, Stability AI, ElevenLabs and Runway keys, and the portal just gives you one consistent interface — chat, image generation, text-to-speech, a code assistant, video generation — over whichever of those you've connected. Billing happens directly between you and the provider. The portal itself charges nothing for API usage, because it never touches the money side at all.

Keys are the one thing that has to be paranoid

The whole trust model of a BYOK product rests on one thing: can users believe their API keys — which are effectively bearer tokens for their own paid accounts — are safe. Every key is encrypted with AES-256-GCM before it touches the database, with a unique nonce per key (so two identical keys never produce identical ciphertext, which matters for preventing pattern analysis against the stored blobs). The master key lives in a config file that's explicitly blocked from direct HTTP access at the nginx level, as a second layer independent of PHP actually executing the file correctly.

function encryptApiKey(string $plaintext): array {
    $key   = hex2bin(MASTER_KEY);
    $nonce = random_bytes(12);
    $tag   = '';
    $cipher = openssl_encrypt($plaintext, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
    return ['enc' => base64_encode($cipher . $tag), 'nonce' => base64_encode($nonce)];
}

Nothing exotic — GCM gives you authenticated encryption for free, so a tampered ciphertext fails to decrypt rather than silently returning garbage.

Two identities, one login, no forced choice

AI Hub is a sibling project to findnix.eu, a GDPR-focused EU search engine, and that created an actual product question: should AI Hub have its own user accounts, or piggyback on findnix.eu's existing ones?

The answer ended up being both, deliberately. At signup you choose: a standalone AI Hub account, or one linked to your findnix.eu account with a shared login. Existing findnix.eu users don't have to fill out a second registration form at all — a link in their findnix.eu account silently provisions a linked AI Hub identity and drops them straight into the dashboard, authenticated.

That "silently provisions" step runs over a short-lived, single-use signed token rather than any shared session or cookie trickery between the two domains:

function consumeSsoToken(string $token): ?int {
    $row = /* look up token, reject if used or older than 60s */;
    mark token used;
    $aiUserId = /* look up existing linked account for this findnix user */;
    if ($aiUserId) return $aiUserId;
    // first time: silently create a linked AI Hub account, no form involved
    return createLinkedAccount($row['fnx_user_id']);
}

For linked accounts, password checks go straight to findnix.eu's own password hash rather than a duplicated one — one password, one source of truth, even though the two products keep separate account tables.

Least privilege, even between your own apps

Because AI Hub and findnix.eu now share a physical database (AI Hub's tables live in the same schema with their own prefix, rather than a separate database), it would have been easy to just reuse findnix.eu's own full-access database credentials for AI Hub too. Instead AI Hub gets its own MySQL user, scoped to SELECT, INSERT on the shared users table (enough to look up and create linked accounts) and full access only to its own tables. It's internal plumbing nobody using the product will ever see, but it means a bug in a comparatively young, less-battle-tested part of the stack can't reach past its own tables into the main product's data.

What's next

The provider list — Claude, GPT-4o, Gemini, Mistral, DALL-E, Stability AI, ElevenLabs, Runway — covers the obvious ground, but "bring your own key" as a model scales naturally to whatever shows up next; adding a provider is a new small API wrapper file and an entry in a provider list, not a pricing renegotiation.

If the BYOK model is something you'd rather use than another flat-rate AI subscription: ai.findnix.eu.

DEV Community