Where the key lives

Your API key never leaves your browser except to reach the provider that issued it.

That is the whole answer, and it is worth stating plainly because it is the first thing anyone asks about a bring-your-own-key feature. The rest of this page is the detail behind it, including the part the product is careful not to overstate.

Where it goes

When TabOasis runs an AI action, the request is made from your browser directly to OpenAI or to Google, using their official client libraries and your key. There is no TabOasis proxy in the middle. Our servers never see the key, never see the prompt, and never see the answer.

Two consequences follow:

• Nothing works without your key, including offline or if the provider is down. There is no fallback and no shared quota to fall back on.
• The usage on your provider’s dashboard is the whole picture. If it shows a request, TabOasis made it from your machine.

One request is worth naming because it is the exception to how the rest are made: when TabOasis asks Gemini which models your account can use, the key travels in the request’s URL rather than in a header. It still goes only to Google, but URLs are the part of a request most likely to end up in a log. Every other Gemini call, and every OpenAI call, sends it as a header.

It is not in anything you send us

• Not in Cloud sync. The uploaded blob carries your profiles, focus data and settings. AI settings live in a separate place on the device and are deliberately not part of it.
• Not in Export JSON or a profile export. Neither format has a field for it, so a backup you hand to someone else does not carry your key.
• Not in usage statistics or a bug report.

“Encrypted key storage”, precisely

Once saved, the AI panel shows AI configured with encrypted key storage. That is true, and it is narrower than it sounds, so here is the honest version.

The key is encrypted before it is written to browser storage, which keeps it out of plaintext in a storage dump or an export. But the encryption key is derived from things any code running in this browser profile can work out for itself.

So treat it as obfuscation at rest, not as security. It protects your key from being read out of a file. It does not protect it from someone who can run code in your browser — if that is true, they can decrypt it, and they could equally read anything else the browser holds.

The practical advice is the same as for any API key:

• Give it the smallest scope and lowest spending cap your provider allows.
• Do not use a key that also runs something important elsewhere.
• If a machine is lost or shared, revoke the key at the provider. Removing it in TabOasis only removes this copy.

A browser update can forget it

Because the encryption is tied to the browser environment, a browser update can change what that derivation produces. When it does, the stored value can no longer be decrypted.

TabOasis handles that by treating the key as not configured and asking you to paste it in again. That is deliberate: the alternative was handing the provider a garbled key and leaving you to work out why every request returned an authorisation error.

So: if AI suddenly reads Not configured and you have not touched anything, that is what happened. Paste the key again; nothing else is affected.

Removing it

The remove button on the API key field deletes this browser’s copy. It does not revoke the key — only your provider can do that — and it does not touch the key stored for the other provider.

Uninstalling the extension removes it along with everything else.