API key security — how TKReel protects your keys

TKReel is free and runs on your own provider key (BYOK — bring your own key): a Volcengine Ark key or a fal.ai key. That only works if you can trust how the key is handled, so this page states exactly what TKReel does with it — nothing more, nothing less.

Stored encrypted with AES-256-GCM

When you save a key, it is validated first and then stored encrypted with AES-256-GCM. The master encryption key is configured on the server separately from the database: it lives in a server environment variable, not in the database, so a database copy on its own cannot reveal your key.

Decrypted only at generation time

Your key is decrypted only at generation time, so TKReel can call the provider on your behalf. Generation jobs are queued with only a task ID — your key never enters queue payloads, and it is never written to logs. The worker resolves the key in memory when the job runs.

Only the last 4 characters are ever shown

The interface only ever shows the last 4 characters of your key, as a label so you can tell which key is saved. The full key is never displayed again after you save it.

You can replace or delete it at any time

In Account Center you can replace your key with a new one, or delete it entirely, whenever you like. After deletion, generation is unavailable until a new key is saved — there is no fallback key and no shared account.

Costs settle on your own provider account

All model costs settle on your own provider account at official rates. TKReel never touches the money and charges no generation fee; your provider console is the single place where usage and billing appear.

Start creating