Your agent signs every transaction
Trades come back unsigned. Your agent signs them and holds its own private keys. No keyfo API or MCP tool takes one.
Trust
Security
How keyfo handles keys, money and data.
Your own API keys are shown once
We show a new key once and store only a salted SHA‑256 hash, so we can’t show it again. Keys sent in a URL are cut from our server logs.
Calls draw from an allowance
A trial key draws from the visitor’s free daily allowance. A wallet key draws from the daily allowance of its $KEYFO tier, reset at 00:00 UTC. Revoke a key in the app at any time.
Sign-in without a transaction
You sign a message with your wallet. No transaction and no gas.
We don’t store prompts
Prompts and replies are not stored. For each call we log the time, key, model or tool, tokens, cost and status.
To answer, a request passes through a model routing service to the provider of the model you pick. Each of them handles it under its own policies.
A connector URL carries your key
A connector URL with your key works like the key. Revoke the key in the app if its URL leaks.
Trial keys stay in your tab
A trial key is kept in this browser tab so the setup steps can use it. It expires after 24 hours.
No deposits
There is nothing to deposit. Your $KEYFO stays in your wallet, and keyfo only reads its balance.
Verify addresses
Compare any address you’re given with these before you send anything.
- $KEYFO contractView on explorer
Report a vulnerability
Report security issues privately: DM @keyfomcp on X or write to support@keyfo.xyz.