Seal a key

This page encrypts your provider API key in your browser, so you can give it to the Umbris bot without the key ever passing through Discord.

Paste your API key and your Discord user id below, then press Seal my key.

Copy the sealed blob.

In a DM with the bot, run /setkey, paste the blob and pick the provider.

Nothing you type here leaves this page. Sealing makes no network requests; the only thing the page loads is the site's two font files, and it works offline or saved to your computer.

What happens to your key: read this before entering one

Your stored credential is encrypted under the server's key-encryption key (KEK). On this deployment the KEK is in .env on the same disk: a copy containing both the vault and KEK can decrypt your credential.

The operator can decrypt stored credentials and read keys while they are in use. Browser sealing keeps the API key out of Discord; it does not hide it from the bot or its operator.

Use a separate provider key and set a provider-side spending limit where supported. Revoke it at the provider when you stop using it or suspect exposure. This bot does not enforce a monetary budget.

No reliability, no liability, no responsibility. This is best-effort software: it can be down, wrong or broken. Your key pays for requests made on your behalf, including ones you did not intend.

This bot has no provider sign-in flow that creates a key for you. /revokekey removes the bot's stored copy; it does not revoke the key at the provider.

There is no spend cap on the bot's side; the cap you set at the provider is the only one that exists.

Channel backread is on your bill too. A reply can include recent channel messages from other members, not just your own. The amount depends on server configuration, available history and message lengths; there is no fixed token cost per ping. Ask the operator about backread settings.

Seals to the bot key with fingerprint (not checked yet)

Your API key Never leaves this browser tab. Your Discord user id Digits only. In Discord: Settings, Advanced, turn on Developer Mode, then right-click your name and choose Copy User ID. The id is sealed in, so the blob works only for you. Opened from the terminal's Seal a key link, the page fills it in for you.

Check this page yourself

Load the page, turn your network off, then seal a key: it still works, because sealing sends nothing anywhere.
Download this page and open the file from disk: it is the same bytes, and it works the same.
Compare the download's SHA-256 and the fingerprint above with the ones on umbris.org's About page, and the fingerprint with the one the bot prints at startup. The fingerprint identifies the key; a page that has been swapped can show its own, so it does not prove the page is genuine.
The page's Content-Security-Policy pins its script and its styles to their exact bytes: a changed script does not run, and this notice and the warning above stay.