How can we help?

Go to www.getkeysentry.com and click Sign In. You can sign in with Google (recommended) or with your email and password. If you don't have an account yet, click Sign Up to create one. First-time users are on the Starter plan by default.

From the Overview dashboard, click the purple + Add credential button in the top right. Fill in: name, platform (Anthropic, OpenAI, etc.), environment (prod/staging/dev), your API key, expiry date, and optional rotation schedule. Click Save — your key is encrypted with AES-256-GCM before it touches the database.

KeySentry AI natively supports Anthropic, OpenAI, AWS Bedrock, Google AI, and Azure OpenAI as built-in platforms. You can also add custom platforms via the Platforms tab — including Cohere, Mistral, Groq, Hugging Face, Perplexity, Together AI, Replicate, Stability AI, ElevenLabs, Pinecone, Weaviate, and OpenRouter from the Quick Add presets, or any custom platform via the Custom Platform builder.

New accounts are seeded with 21 demo credentials across 5 AI platforms so you can explore the full feature set immediately. These are clearly labelled demo credentials — no real API keys. You can delete them at any time and start adding your own real credentials. To seed demo data again, use /api/seed (admin only).

Click the sun ☀️ or moon 🌙 icon in the top right of the dashboard. Your preference is saved automatically and persists across sessions.

Click any credential row to open the Detail Panel. You'll see the masked key (e.g. sk-····prod). Click Reveal to see the plaintext key — you'll be asked to confirm. Click Copy to copy it to your clipboard without revealing it on screen. Keys are decrypted on demand and never stored in plaintext.

Green — Active: The key is valid and not expiring soon.

Yellow — Expiring: The key expires within 14 days. You'll receive an email alert. Rotate or renew immediately.

Red — Expired: The key has passed its expiry date. It may still work depending on the platform, but it should be replaced immediately.

Click the credential row to open the Detail Panel. You can update the expiry date, rotation schedule, and other metadata directly from the panel. To change the actual API key value (e.g. after rotating externally), use the Mark Rotated button which prompts you to enter the new key.

You can delete a credential two ways: click Delete on the credential row in the table, or open the Detail Panel and click Delete at the bottom. You'll be asked to confirm. Deletion is permanent and logged in the Audit Log. Only Admins and Managers can delete credentials.

KeySentry supports three environments: prod (production), staging, and dev (development). You assign the environment when adding a credential. This helps you filter and organize credentials by context — for example, viewing only production credentials for a compliance review.

There are two ways:

From the Rotation tab: Go to Sidebar → Security → Rotation. Find your credential and click ↻ Rotate. This marks it as rotated, resets the cycle, and logs the event.

From the Detail Panel: Click any credential → click Mark Rotated. You'll be prompted to enter the new API key value. KeySentry then sends a confirmation email and resets the rotation schedule.

When adding or editing a credential, set the rotation interval: 30 days (high security), 60 days (standard), or 90 days (low risk). KeySentry tracks where you are in the cycle with a visual health bar and sends email reminders before the rotation is due. Overdue rotations are flagged in red on the Rotation tab.

Check these in order:
1. Check your spam/junk folder — emails come from noreply@getkeysentry.com
2. Confirm your email is correct in Settings → Profile
3. Check Settings → Notifications — ensure email alerts are enabled
4. Verify the credential has a rotation schedule set (it won't alert without one)
5. The daily cron runs at midnight UTC — alerts arrive within that window

If none of these resolve it, contact support@getkeysentry.com.

Overdue: Rotation date has passed. Rotate immediately.
Due Soon: Rotation due within 7 days. Plan your rotation now.
Upcoming: Rotation due within 30 days. No action needed yet.
Healthy: Rotation is on schedule. No action needed.

The Rotation Health Bar in the Credential Detail Panel shows how far through the current rotation cycle you are. For example, "Day 24 of 30" means you have 6 days until rotation is due. Green = healthy, Yellow = due soon, Red = overdue. The bar resets to zero every time you click Mark Rotated.

Go to the Team tab (topbar or sidebar). Click Invite Member. Enter their email address, select their role (Admin, Manager, or Viewer), and optionally set a monthly budget cap. They'll receive an email invitation to join your KeySentry workspace. Only Admins can invite new members.

Admin: Full access — add/edit/delete credentials, manage team, change settings, view billing, export all reports.

Manager: Can add and rotate credentials, view all credentials, manage their own team members, export reports. Cannot change billing or delete the workspace.

Viewer: Read-only access — can see credential status and expiry dates but cannot reveal keys, rotate, or make changes. Ideal for auditors and stakeholders.

A budget cap sets a monthly spending limit for a team member's credentials. When spend tracked via the connected billing API approaches or exceeds the cap, KeySentry sends an alert to the Admin. This helps prevent runaway AI costs from individual team members. Set budget caps in Team → Budgets when inviting or editing a member.

Go to Sidebar → Security → Access Control → Access Policies. Enable IP Allowlist and add your trusted IP addresses or CIDR ranges. Once enabled, credential access and sign-ins are only permitted from allowlisted IPs. The emergency lockdown button (also on this page) immediately blocks all access across all credentials in one click.

The Usage & Spend tab pulls live billing data from your connected AI platforms via their billing APIs. Connect your platforms in Sidebar → Connectors. Once connected, KeySentry shows real-time spend, token usage, and API request counts per platform — updated on demand via the Refresh button. Click any of the four stat cards (Total Spend, Total Tokens, API Requests, Budget Remaining) to change the chart view.

Go to Sidebar → Connectors. Click Connect on any platform. You'll be guided to:
1. Generate a billing API key (read-only) in your platform's dashboard
2. Paste it into KeySentry's Connect modal
3. Click Save — the connector is live immediately

Note: Use a read-only billing key, never your main API key. KeySentry only reads spend data — it never makes API calls on your behalf.

KeySentry AI is currently in early access — pricing is being finalized. Join the waitlist to be notified when pricing is announced, and to lock in early-access rates. Enterprise custom pricing is available — contact raj@getkeysentry.com.

Every credential is encrypted using AES-256-GCM before it is written to the database. The encryption master key is stored separately from the data (in Vercel environment variables, not in the database). Keys are never stored in plaintext — not in logs, not in backups, not in transit. Decryption only happens on-demand when you explicitly click Reveal.

The Audit Log records every action in your workspace with a timestamp and the user who performed it, including: credential added, viewed, revealed, rotated, deleted — team member invited or removed — role changes — sign-ins and sign-outs — IP allowlist changes — emergency lockdown events — report exports. The log is immutable and cannot be edited or deleted, making it suitable for SOC 2 and HIPAA compliance evidence.

Emergency Lockdown (Sidebar → Security → Access Control) immediately suspends all credential access across your entire workspace with one click. Use this if you suspect a breach or unauthorized access. All team members are logged out, all credential reveals are blocked, and the event is logged. Only an Admin can restore access by clicking Restore Access.

Yes. KeySentry's Compliance Report (Settings → Reports & Export → Compliance Report) maps your security controls to SOC 2, HIPAA, FedRAMP, and NIST 800-53 frameworks, showing PASS/REVIEW status per control. Download as PDF or JSON. This report is designed to be submitted as evidence during audits. For formal certifications, contact raj@getkeysentry.com.

Go to Settings → Reports & Export (topbar or sidebar). Choose from 7 report types: Credentials Report, Audit Log Report, Rotation Schedule, Usage & Spend, Team Access Report, Compliance Report, and Full Export. Click CSV, PDF, or JSON to download. CSV works in Excel and Google Sheets. PDF generates a branded report with a confidentiality footer. JSON is for API integrations and SIEM tools.

The Full Export (JSON only) includes everything in your workspace in a single timestamped file: all credentials (metadata only — no plaintext keys), complete audit log, team member list and roles, billing connector status, and summary statistics. Use for data backup, SIEM ingestion (Splunk, Datadog), or offboarding. The export is signed with your workspace ID for authenticity verification.

PDF generation runs client-side. Try these steps:
1. Disable any popup blocker for getkeysentry.com
2. Try a different browser (Chrome recommended)
3. Check your Downloads folder — it may have downloaded silently
4. Clear browser cache and try again

If the issue persists, use the CSV or JSON export as an alternative, or contact support@getkeysentry.com.