Worthless wraps your existing app with a transparent proxy. Your code never sees the full key — and neither does an attacker who gets hold of your .env or git history.
Run worthless lock. It scans your .env, detects API keys, and splits each one using XOR secret sharing. Share A is written to local encrypted storage. Share B lives in the proxy process memory only — never on disk. Your .env is updated to point at the proxy.
Prefix any command with worthless wrap. The proxy intercepts outbound API requests, reconstructs the full key in memory for the duration of the call, forwards the request, then zeroes memory immediately. Your code doesn't change.
Before reconstructing the key, the proxy checks your spending counter. If the budget is reached, the proxy refuses — even if both shares are available. This is a hard stop at the infrastructure layer. No alerts to miss, no override from the app side.
Add the Worthless hook to prevent raw keys from ever reaching git history. First line of defense — the split-key proxy handles everything that slips through.
Run worthless unlock at any time. Original keys are restored, the proxy stops, no traces remain. No lock-in. No dependency on Worthless to keep your app running.