Rumrunner

Keys and the Keychain

With no key stored, nothing ever leaves your Mac. Add one and the router may use that provider's lane, every such request an explicit route with its reasons logged.

Where a key lives

In the macOS Keychain, as a generic password under the service ai.rumrunner, one item per provider. It is marked non-synchronising, so it does not ride iCloud Keychain to your other devices, and readable after first unlock on this device only, so it does not travel in a backup to another machine.

Where it never does

  • Not in a config file. config.toml and rules.toml hold no secrets and can be pasted anywhere.
  • Not in a log. The decision log and the request log carry no credentials, and rr status --report is tested to contain none.
  • Not in an error message. A rejected key is described by its shape, never by a character of its value.
  • Not in the app. The Settings screen writes a key to the Keychain and clears the field; nothing in the app ever reads one back, and there is no reveal toggle because a masked field is still a real string in a screenshot.

Adding one

In the app: Settings, then the provider's row. Or from a terminal, which prompts without echoing and never takes the key as an argument, so it is not in your shell history:

rr keys set anthropic
rr keys list
rr keys rm anthropic

Provider ids are lowercase and fixed: anthropic, openai, deepseek on the frontier lane; together, fireworks, groq on the nearshore lane. rr keys list reports which providers have a key and never prints one.

A paste is checked against the provider's key shape before it is stored, because echo-suppressed entry hides a truncated or doubled paste until the provider answers 401. If a provider changes its format, --force stores it anyway.

What a key costs you

Whatever the provider charges, and nothing more. Frontier tokens are billed by Anthropic, OpenAI or DeepSeek on your own account at their price; Rumrunner adds no markup and takes no cut of your inference. The receipt shows what each paid request actually cost beside what it would have cost at frontier rates, so you can check that claim line by line.