TrendSmart — AI-powered POD autopilot now liveEasyFlip — List once, sell on 8 marketplacesStoreGuard — Real-time Shopify fraud detectionRaffleBattle — Catch every fake entry instantlyShipSense — AI shipping optimizer for ShopifyReturnShield — AI return fraud detectionPriceWolf — Dynamic competitor price trackingBookified — AI storybooks from your photosFree Strategy Call consultation availableBuilt with research-grade AI — 10+ shipped productsTrendSmart — AI-powered POD autopilot now liveEasyFlip — List once, sell on 8 marketplacesStoreGuard — Real-time Shopify fraud detectionRaffleBattle — Catch every fake entry instantlyShipSense — AI shipping optimizer for ShopifyReturnShield — AI return fraud detectionPriceWolf — Dynamic competitor price trackingBookified — AI storybooks from your photosFree Strategy Call consultation availableBuilt with research-grade AI — 10+ shipped products
An AISpec Product · Open Source

The AI provider dashboard
you wish existed.

Stop logging into sixteen dashboards. Prism is a local macOS app that manages, rotates, and audits API keys directly on every AI provider you use — OpenAI, Anthropic, Google, Mistral, and a dozen more. Your keys stay on your machine.

14 of 16 providers live-proven
AES-256-GCM · Argon2id
MIT licensed · no telemetry
OP
AN
GO
CO
MI
OP
PE
XA
GR
TO
FI
DE
RE
HU
EL
ST
The magic moment

Find the keys you forgot you had.

Every time you connect an account, Prism audits the provider's own console and surfaces every key that exists — including orphans your CI, a previous rotation, or a teammate left behind. Adopt, rename, or delete in one click.

Discovers every key, everywhere
Connect an OpenAI account and Prism lists every key across every project — not just the one you pasted. Same for Anthropic, Google, Cohere, and every other provider.
Catches the orphans automatically
Generic labels like "auto-rotated-…", "new", "temp", "secret" get flagged. Never-used keys (cost $0, last-used never) get flagged. One glance tells you what to clean up.
Adopt into the vault with a click
A key you recognize? Click Adopt. Prism gives it a proper name, pulls it into the vault, starts tracking age and spend. No manual copy-paste.
Remove N unused — one button
After an audit, the "Remove 5 unused" button deletes every orphan at the provider in a single session. Tested nightly on the author's own accounts.
Provider audit
Keys discovered on the provider
Adopt the ones you recognize · rename unclear labels · delete orphans
8 keys · 5 never usedRemove 5 unused
shop-prod-chrome
sk-proj-CNa…oQAA
newness
sk-proj-Obg…ewAA
secretgeneric
sk-proj-e6O…2gAA
auto-rotated-1776671385915genericnever used
sk-proj-iPu…TAAA
auto-rotated-1776670126071genericnever used
sk-proj-fK-…cwAA
auto-rotated-1776668962697genericnever used
sk-proj-s6C…NAAA
auto-rotated-1776388043917genericnever used
sk-proj-xhO…3QAA
auto-rotated-1776377334546genericnever used
sk-proj-drH…KwAA
Real-world proof

On the author's first run against an Anthropic account, Prism discovered 14 keys including 10 auto-rotated orphans nothing else would have surfaced. One Remove 10 unused click later: a clean dashboard of exactly the 3 keys that actually matter.

Coverage

Works with 16 providers on day one.

Every provider either has a native management API or a Playwright adapter. Click any tile to see how the integration works under the hood. Add your own in 30 seconds.

14 live-proven· All 16 code-complete
Architecture

Three-tier design. Adapter pattern.

A UI layer, a Go core with encrypted vault + adapter registry, and a transport layer that speaks REST where providers expose one, Playwright (with stealth) where they don't. Swapping a provider means touching one adapter file.

01
UI · Wails (Go + React)
React/TypeScript frontend with 20 design variants. Talks to the Go core over the Wails IPC — no HTTP server, no ports to open.
02
Core · Vault + Registry
AES-GCM encrypted SQLite vault, Argon2id-derived KEK, provider registry that routes any operation to the right adapter. User-added providers plug into the same registry at runtime.
03
Transport · REST + Playwright
REST adapters where providers offer one (OpenAI, Google, OpenRouter). A generic Playwright daemon everywhere else — one config per provider tells it where keys live and how to scrape them.
Cold vs warm sessions
First run · headful login
~30–60s
Subsequent runs · cached session
~2–5s
Security

Your keys, your machine.

Prism is local-first by construction, not by promise. Six pillars, all open to audit.

AES-256-GCM at rest
Every secret in the vault is sealed with AES-256-GCM using a random per-record nonce. The KEK never touches disk.
Argon2id key derivation
Your master passphrase is stretched with Argon2id (memory-hard, GPU-resistant). Lose the passphrase and the vault is unrecoverable — there is no reset by design.
Local-only. No telemetry.
No cloud, no sync, no account. Prism makes no outbound requests except to the provider consoles themselves.
Ephemeral provider sessions
Cookies live in a per-account persistent-context directory, encrypted by the OS. Sessions are short-lived and isolated between providers.
Auditable Playwright scripts
Every scrape runs through a transparent Node + Playwright script you can read in the repo. No hidden native binaries; no obfuscation.
MIT-licensed, open source
The whole thing is public on GitHub. Build it from source, fork it, or audit the release DMG against the tagged commit.
Getting started

Four steps to your first audit.

Opinionated defaults. No configuration files. No service to spin up.

1
Download & install
Grab the macOS .app bundle from Releases. Install into /Applications. Runs fully offline.
2
Set a master passphrase
First launch asks once. Stored as an Argon2id hash — lose it and the vault is unrecoverable by design.
3
Connect a provider
Pick one of 16 presets (or register a custom provider). Prism runs the login headlessly or pops a browser for you to sign in, then audits what exists.
4
Rotate anything
Keys past 30 days get flagged. Click Rotate, confirm the blast-radius checklist, done.
Power user · CLI tools ship in the repo
$ ./verify-all # sweep every provider
$ ./live-verify -provider mistral -force-login
$ ./live-cleanup -sweep-unused -confirm # nuke orphan keys
$ ./prism-probe -code MYPROV -url ... # add a new provider
FAQ

Straight answers.

No. The vault is local-only, encrypted with AES-256-GCM. Prism makes no outbound requests except to the provider consoles themselves (to audit and rotate keys). There is no Prism Cloud, no telemetry, no account.

Take back control of your AI keys.

Free. Open source. MIT licensed. Runs on your Mac — not on a server.