FakeKey — a Rust-based API key security tool that replaces real keys with fake ones, making leaks useless even in compromised agent environments.

Over the past few days, we’ve seen incidents like LiteLLM and Axios supply chain attacks. When libraries at that scale get poisoned, they can start scanning and exfiltrating API keys immediately. In our openclaw, a large number of API keys are exposed in environment files — including LLM keys tied to billing, as well as sensitive tokens like Feishu (Lark) keys.

The reality is: it’s almost impossible to guarantee that all the software and NPM dependencies we use are safe. These attacks are often discovered only after the damage is done.

So instead of trying to “prevent poisoning,” we changed the approach: make leaks meaningless.

That’s why we built FakeKey.

FakeKey replaces real API keys with fake ones. Agents and dependencies only ever see fake keys, while the real keys are securely encrypted and stored in the system’s native keychain. Only at the moment an HTTP/S request is sent, the real key is injected back in.

Even if a dependency is compromised, the attacker can only steal useless strings.

GitHub: https://github.com/happyvibing/fakekey