sidharthpunathil/acnologia

Share your API keys without giving them away.
API keys get passed around in .env files, chat messages and CI settings.
Once a key is out, you cannot take it back, you cannot see who is using it,
and the only way to stop them is to rotate it for everyone.
Acnologia is a self-hosted key server. You add your keys once. Every app,
script, AI agent, teammate or other server gets its own token and calls the
API through Acnologia, which attaches the key on the way out. You decide
which keys each one may use, how much, and for how long, and you can revoke
any of them in one click without touching the key itself.
One Go binary with the dashboard built in, for Linux, macOS and Windows.
SQLite storage, keys encrypted at rest with AES-256-GCM.
## Who you can share with
| Share with | What they get | What they see |
| An app or script | Its own acn_ token for the proxy | Nothing but responses |
| An AI agent | The same token over MCP at /mcp, or plain HTTP | Nothing but responses |
| A person who does not run Acnologia | A one time link, then a personal token, ready made snippets and a My access page | Nothing but responses |
| Another Acnologia server | An invite bound to that server's identity | Nothing, in proxy mode |
In proxy mode the key never leaves your server, so revoking a share stops the
next request. For the cases where the other side needs the raw key there are
explicit modes: lease (an app borrows a key for a short time), handover (keys
sealed to another server, deleted there when the share ends) and reveal (a
person sees the keys once). Acnologia marks every key that left this way, and
when such a share ends it lists exactly which keys to rotate.
## Control every share
Pick the keys. All of a service's keys, up to N of them, or a hand
picked list.
Set limits. Daily or monthly request caps and a USD budget per app or
share, reserved before each call so a burst cannot overshoot them.
Set a timer. End a share after an hour, a day, a week or at a set time,
and choose whether it expires (you can extend it) or is revoked for good.
Pause, resume, revoke. Each takes effect on the next request.
See the use. Requests, spend and last use per share, and an audit log
of every change and every reveal.
## Keys that keep working
Sharing a pool of keys only helps if the pool stays healthy, so Acnologia
looks after it:
A rate limited key rests for as long as the provider asked, a key out of
quota waits for its reset, and a revoked or suspended key leaves rotation
once a health check confirms it. An outage at the provider opens a circuit
breaker instead of blaming your keys.
Keys are picked round robin, fill first, least used, most quota left or
weighted random, with backup keys and per key concurrency limits.
Identical GET requests can be answered from a response cache, and retried
POSTs with an Idempotency-Key are replayed instead of sent twice.
## Quick start
One command installs the server, starts it in the background and keeps it
running across restarts. On macOS or Linux:
sh
curl -fsSL https://raw.githubusercontent.com/sidharthpunathil/acnologia/main/setup.sh | sh
On Windows, in PowerShell:
powershell
irm https://raw.githubusercontent.com/sidharthpunathil/acnologia/main/setup.ps1 | iex