Plant a key. Catch the thief.

Honeykey generates inert canary credentials — fake API keys and URLs that belong to no real account. Plant them in your own repos, configs and wikis. The moment a stolen-key buyer or scanner tries one, your tripwire Worker alerts you with their IP, user-agent and timestamp.

1 · GENERATE

Create canaries that look exactly like OpenAI, Anthropic, AWS, GitHub or generic keys — each with a unique embedded ID.

2 · PLANT + DEPLOY

Drop them where real keys leak: old repos, config examples, team wikis. Deploy the generated Worker (free tier) as the tripwire.

3 · GET ALERTED

Any use of a canary is hostile by definition — nobody legitimate has it. The Worker answers like a dead key and pings your webhook instantly.

Your assets only. Canaries are for systems and documents you own. They are inert fakes — never real provider credentials — and the tripwire only ever sees people who chose to use a key that was never theirs.

1 · Generate a canary

Free tier: 1 canary. Pro: unlimited canaries, every format, batch placement kits.

Format Label — where will you plant it? Your Worker base URL (for URL canaries + snippets)

2 · Your canaries

Stored only in this browser (localStorage). Copy a placement snippet for each canary and plant it. Full values are shown here — this page is your vault, guard it like one.

No canaries yet. Create your first one above.

3 · Your tripwire Worker

This generates a personalized Cloudflare Worker with your canary registry baked in. Deploy it on Cloudflare's free tier (Workers → Create → paste → Deploy). Optional KV binding named ALERTS keeps an alert log; the webhook fires either way.

Alert webhook URL (Discord / Slack / generic — optional)

Deploy the Worker. Note its URL — it should match the base URL you used for your canaries.
Plant your canaries (snippets in section 2). Never mix a canary into a file with real credentials you still use — a trip means that file leaked.
Test it: open a canary URL in a private window, or send a request with a canary key. You should get a provider-style 401 — and an alert.

Pro — $19 one-time

Unlimited canaries across every format, batch placement kits, and priority formats as new providers appear. One payment, yours forever — same model as LLMJACK/SHIELD.

No keys, no setup: the moment checkout completes, Stripe brings you straight to the Pro version of this page. Your Pro link is also in your Stripe receipt email — bookmark it.