Security
API key encryption
How BYOK keys should be handled.
BYOK API keys are sensitive. The app should never treat them as product data.
Provider keys are secrets
OpenStar should store only the encrypted server-side secret and expose key status, not the key itself.
Policy
| Area | Expected behavior |
|---|---|
| Storage | Store API keys server-side after encryption. |
| UI | Show whether a key exists, never reveal the secret. |
| Removal | Allow the user to delete the provider key from settings. |
| Failures | Surface provider errors directly. |
| Fallback | Do not silently switch to another provider or model. |
Lifecycle
User selects provider, model, base URL, and API key.
Server validates and stores encrypted key material.
Chat uses the configured provider explicitly.
User can remove or replace the key from settings.