Bring Your Own Key: Building an AI Portal That Never Touches the Billing

AI Hub, a bring-your-own-key AI portal from the team behind the GDPR-focused EU search engine findnix.eu, offers a unified interface for chat, image generation, text-to-speech, and more, while never handling billing. The portal encrypts user API keys with AES-256-GCM and uses a separate MySQL user with limited privileges to protect data. It also supports seamless single sign-on with findnix.eu using short-lived, single-use tokens.

Every few months another "all AI models in one place" product shows up, and almost all of them work the same way: you pay them a subscription, and they resell access to Claude, GPT-4, Gemini and friends at a markup. That's a reasonable business, but it's not the only way to build this, and it's not the way ai.findnix.eu https://ai.findnix.eu works. AI Hub is a bring-your-own-key portal: you paste in your own Anthropic, OpenAI, Google, Mistral, Stability AI, ElevenLabs and Runway keys, and the portal just gives you one consistent interface — chat, image generation, text-to-speech, a code assistant, video generation — over whichever of those you've connected. Billing happens directly between you and the provider. The portal itself charges nothing for API usage, because it never touches the money side at all. The whole trust model of a BYOK product rests on one thing: can users believe their API keys — which are effectively bearer tokens for their own paid accounts — are safe. Every key is encrypted with AES-256-GCM before it touches the database, with a unique nonce per key so two identical keys never produce identical ciphertext, which matters for preventing pattern analysis against the stored blobs . The master key lives in a config file that's explicitly blocked from direct HTTP access at the nginx level, as a second layer independent of PHP actually executing the file correctly. php function encryptApiKey string $plaintext : array { $key = hex2bin MASTER KEY ; $nonce = random bytes 12 ; $tag = ''; $cipher = openssl encrypt $plaintext, 'aes-256-gcm', $key, OPENSSL RAW DATA, $nonce, $tag, '', 16 ; return 'enc' = base64 encode $cipher . $tag , 'nonce' = base64 encode $nonce ; } Nothing exotic — GCM gives you authenticated encryption for free, so a tampered ciphertext fails to decrypt rather than silently returning garbage. AI Hub is a sibling project to findnix.eu https://findnix.eu , a GDPR-focused EU search engine, and that created an actual product question: should AI Hub have its own user accounts, or piggyback on findnix.eu's existing ones? The answer ended up being both, deliberately. At signup you choose: a standalone AI Hub account, or one linked to your findnix.eu account with a shared login. Existing findnix.eu users don't have to fill out a second registration form at all — a link in their findnix.eu account silently provisions a linked AI Hub identity and drops them straight into the dashboard, authenticated. That "silently provisions" step runs over a short-lived, single-use signed token rather than any shared session or cookie trickery between the two domains: php function consumeSsoToken string $token : ?int { $row = / look up token, reject if used or older than 60s /; mark token used; $aiUserId = / look up existing linked account for this findnix user /; if $aiUserId return $aiUserId; // first time: silently create a linked AI Hub account, no form involved return createLinkedAccount $row 'fnx user id' ; } For linked accounts, password checks go straight to findnix.eu's own password hash rather than a duplicated one — one password, one source of truth, even though the two products keep separate account tables. Because AI Hub and findnix.eu now share a physical database AI Hub's tables live in the same schema with their own prefix, rather than a separate database , it would have been easy to just reuse findnix.eu's own full-access database credentials for AI Hub too. Instead AI Hub gets its own MySQL user, scoped to SELECT, INSERT on the shared users table enough to look up and create linked accounts and full access only to its own tables. It's internal plumbing nobody using the product will ever see, but it means a bug in a comparatively young, less-battle-tested part of the stack can't reach past its own tables into the main product's data. The provider list — Claude, GPT-4o, Gemini, Mistral, DALL-E, Stability AI, ElevenLabs, Runway — covers the obvious ground, but "bring your own key" as a model scales naturally to whatever shows up next; adding a provider is a new small API wrapper file and an entry in a provider list, not a pricing renegotiation. If the BYOK model is something you'd rather use than another flat-rate AI subscription: ai.findnix.eu https://ai.findnix.eu .