A cost firewall for your AI bill. TKN shows today’s spend across OpenAI, Anthropic, xAI and Gemini on one screen, checks it against the spend rules you set, and lets you revoke a compromised key from your phone — at the provider, not just in the app.
npx @tknapp/cli login
Stripe and your cloud bill catch finance. Nobody catches a leaked OpenAI key at 02:14 on a Saturday. By the time you notice, you've shipped your runway to a teenager in São Paulo.
Total spend today, sized for the lockscreen. Every model, every key, every watcher in one dense scrollable feed. No charts. No bubbles. Just numbers that change.
The Console is what your on-call sees when the alarm trips. One screen, one number, one decision: kill or hold.
Set a dollar threshold for one provider or across all of them. TKN checks it against your live daily spend and flags the breach in the Console. If it’s already on fire, swipe the red block at the bottom of the screen.
A 90% drag commits. Less, and it snaps back. The thumb is heavy on purpose — accidental revocations cost more than missed spikes.
Ships as @tknapp/cli — the tokn command. No daemon, no telemetry, no Electron. Pipes to whatever your incident process speaks — Slack, PagerDuty, or just a shell that quits and SIGTERMs your worker pool.
TKN ships a Model Context Protocol server. Drop it into Claude Desktop, Cursor, or your custom harness, and your agent gets read+revoke capabilities scoped to its own keys. Self-policing autonomy.
{
"mcpServers": {
"tkn": {
"command": "tokn-mcp"
}
}
}
The mobile enclave is the iOS Keychain; the CLI enclave is ~/.tkn on your machine. The dashboard reads your providers directly. Our servers do not hold your keys.
iOS Keychain (Secure Enclave-backed, device-only) on mobile; per-machine derived key on desktop. Your provider keys aren't uploaded — unless you opt into Pro alerts.
The app locks behind Face ID when keys are present. Reveal and revoke can require a second biometric confirm.
Every revoke, pause, and rule trip is append-only signed JSONL. Pipe it to your SIEM or git-commit it.
Start free on one provider. Go Pro for unlimited providers, push alerts, and the kill switch. The first key you defend pays for the year.
Written to be used at 3 a.m., not skimmed. Direct answers first, real console URLs, sources linked, and a verified date on every page.
Including the ones with awkward answers. If TKN is the wrong tool for what you need, we would rather you found out here than after installing.
No. Provider keys are stored in the iOS Keychain — Secure Enclave-backed, device-only, excluded from iCloud backup — behind Face ID, and TKN calls the providers directly from your phone. TKN is not a proxy, so your model calls never pass through us. The one exception is opt-in: enabling background spend alerts requires keys server-side, encrypted, and you can turn it off and delete them at any time.
No, and no tool reading billing APIs can be. Every major provider reports cost on a daily cadence, because billing is an accounting system rather than telemetry. TKN shows you the day — which is early enough to catch a runaway loop, a model change, or a leaked key before the invoice does. Anything advertising real-time spend is either proxying your traffic or estimating from token counts.
OpenAI needs an organization admin key (sk-admin-…), Anthropic an admin key (sk-ant-admin…), and xAI a management key rather than a standard xai- inference key. Google Gemini has no paste-a-key path at all — its spend lives in Google Cloud Billing. We say this up front because it is the most common reason people install and bounce.
It calls your provider's own key-management API and revokes the key at the provider, not just in the app. You choose the scope: one key, one provider, or every key TKN holds. It is a deliberate swipe-to-confirm with a biometric check, and it is irreversible.
The tokn CLI can. `npx @tknapp/cli agents` reads Claude Code's local session logs and prices them — no API key needed, because the token counts are already on your disk. That is a different data source from metered API spend, which is what the app tracks.
No. TKN runs in a demo mode with representative data and no sign-up, so you can see every screen before connecting anything. An account is optional and only enables cross-device sync; you can delete it and its data from inside the app.
It takes 90 seconds. The first key you defend pays for the year.
npx @tknapp/cli login