FREE · 1 CANARY

Plant a key. Catch the thief.

Honeykey generates inert canary credentials — fake API keys and URLs that belong to no real account. Plant them in your own repos, configs and wikis. When someone uses one against your tripwire Worker, you get their IP, country, user-agent and timestamp. A canary trips when it is planted together with its endpoint setting, or when a canary URL is fetched. A bare fake key sent straight to the real provider never reaches your Worker, so plant the pair.

1 · GENERATE

Create canaries that look exactly like OpenAI, Anthropic, AWS, GitHub or generic keys — each with a unique embedded ID.

2 · PLANT + DEPLOY

Drop the key and its endpoint line where real keys leak: old repos, config examples, wikis. Deploy the generated Worker (free tier) as the tripwire.

3 · GET ALERTED

Any use of a canary is hostile by definition. The Worker answers like a dead key, alerts your webhook (de-duplicated so nobody can flood it) and logs it for 90 days if you bind KV.

Your assets only. Canaries are for systems and documents you own. They are inert fakes — never real provider credentials — and the tripwire only ever sees people who chose to use a key that was never theirs.

1 · Generate a canary

Free: 1 canary, any format. Pro: unlimited canaries and a placement-kit download.

2 · Your canaries

Stored only in this browser (localStorage). Copy a placement snippet for each canary and plant it. Full values are shown here — this page is your vault, guard it like one.

No canaries yet. Create your first one above.

Browsers can clear site storage (Safari does after a stretch of inactivity). Keep a backup: if a planted canary disappears from here and you regenerate the Worker, that canary stops tripping.

3 · Your tripwire Worker

This generates a personalized Cloudflare Worker with your canary registry baked in. Deploy it on Cloudflare's free tier (Workers → Create → paste → Deploy). Optional KV binding named ALERTS keeps an alert log; the webhook fires either way.

A webhook URL is a credential. Safer: leave this empty and run wrangler secret put ALERT_WEBHOOK instead. Anything typed here is written into the Worker code in plain text.


    
    
      
  1. Deploy the Worker. Note its URL — it should match the base URL you used for your canaries.
    2. 
      
  2. Plant your canaries (snippets in section 2). Never mix a canary into a file with real credentials you still use — a trip means that file leaked.
    3. 
      
  3. Test it with the curl command shown under each canary. You should get a provider-style 401 and an alert. Unknown requests get a plain 404 so the Worker does not advertise itself.
    4. 
    

  


  

    
Pro — $19 one-time

    
Unlimited canaries and a one-file placement kit (every snippet, test command and planting rule). One payment, yours forever — same model as LLMJACK/SHIELD.

    

      

        
      

      
No keys, no setup: when checkout completes, Stripe brings you straight back here with Pro unlocked on this device. Bookmark the page you land on to unlock another device.