apilive 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,46 @@
+# Changelog
+
+All notable changes to apilive are documented here. This project follows [Semantic Versioning](https://semver.org/) and the [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format.
+
+## [1.1.0] - 2026-09-29
+
+### Added
+
+- **Redesigned app.** A table view with a details panel, an add-keys dialog with a live detection preview, search, status filters and keyboard shortcuts.
+- **Docs inside the app.** The Guide, Changelog, Privacy Policy, Terms of Use, Security Policy, Support and License are available offline from the app.
+- **Update notifications.** At most once a day, apilive checks the npm registry for a newer version and shows it in the app and the terminal.
+- `apilive update` updates a global install in place. For npx users it prints the right command.
+- `apilive privacy` and `apilive terms` print the policies in the terminal.
+- `--no-update-check` flag, plus support for `NO_UPDATE_NOTIFIER`, `APILIVE_NO_UPDATE_CHECK` and `DO_NOT_TRACK`.
+- A first-run notice confirming you'll only check keys you're authorized to use.
+- Releases are published from GitHub Actions with npm provenance.
+
+### Changed
+
+- Provider marks are now neutral monograms. apilive no longer uses provider brand colours, and states clearly that it is not affiliated with any provider.
+- At most 100 keys per session, in both the app and the CLI.
+
+### Fixed
+
+- SambaNova could report a fake key as live when requests came from some regions, which returned an empty 404. Validation-probe providers now count a key as live only when the provider returns a genuine validation error.
+- A 2xx response that isn't JSON (for example a captive portal or bot-challenge page) now shows as unverified instead of live.
+
+### Privacy
+
+- New: the optional update check sends one anonymous request to `registry.npmjs.org`. It contains no keys or usage data. See the [Privacy Policy](PRIVACY.md).
+- New: a small `state.json` in your config folder stores the update-check time and whether you've seen the notice.
+
+## [1.0.0] - 2026-09-29
+
+### Added
+
+- `npx apilive` local web app and `npx apilive check` CLI with exit codes and `--json`.
+- 24 providers, with credit balances for OpenRouter, DeepSeek, Kimi, SiliconFlow and Novita.
+- Scanning of `.env*` files and environment variables, with provider detection by key format or variable name.
+- Five statuses: live, invalid, no credit, rate-limited and unverified.
+- Zero dependencies. The server listens only on your machine and uses Host checks, a session token and a strict Content Security Policy.
+- `npm run verify` proves every provider endpoint rejects a fake key.
+- `--demo` mode for screenshots.
+
+[1.1.0]: https://github.com/parthksingh1/apilive/releases/tag/v1.1.0
+[1.0.0]: https://github.com/parthksingh1/apilive/releases/tag/v1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Parth Kumar Singh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PRIVACY.md

@@ -0,0 +1,74 @@
+# Privacy Policy
+
+**Effective date:** 29 September 2026 · **Applies to:** apilive 1.1.0 and later
+
+apilive is free, open-source software that runs entirely on your own computer. This policy explains what the software does with information, and what the people who maintain it ("we", "us") receive. Short answer: **we receive nothing.**
+
+## Summary
+
+| Question | Answer |
+|---|---|
+| Does apilive collect or sell personal data? | No. |
+| Do the maintainers receive your API keys? | No. We have no servers that receive them. |
+| Is there telemetry, analytics or crash reporting? | No. |
+| Are cookies or trackers used? | No. The local page uses browser storage only for your theme and a one-time notice. |
+| Where do my keys go? | Only to the official API of the provider that issued them, when you ask apilive to check them. |
+| Does apilive connect to anything else? | Only an optional daily update check to the public npm registry, which you can turn off. |
+
+## 1. Who we are
+
+apilive is an open-source project maintained by Parth Kumar Singh and contributors, and distributed under the [MIT License](LICENSE). We do not operate a hosted service. You download the software (for example with `npx apilive`) and run it on your device.
+
+## 2. Information processed on your device
+
+**API keys.** When you paste a key, or when apilive finds one in a `.env` file or environment variable, the key is held **in the memory of the apilive process on your computer**. It is never written to disk or logs, and never sent to your browser in full (the web page receives a masked copy such as `sk-proj…7Hq2`). When you stop apilive, the keys are gone.
+
+**`.env` files and environment variables.** apilive reads `.env*` files in the folder you run it from, plus your environment variables, to look for values that match known API-key formats or variable names. Other values are ignored and never leave your computer.
+
+**Check results.** Status, latency, model lists and credit balances returned by providers are shown to you and held in memory only.
+
+**Browser storage.** The local web page stores two preferences in your browser's `localStorage`: your colour theme, and whether you have seen the first-run notice. This data never leaves your browser.
+
+**Local state file.** apilive writes one small file, `state.json`, in your user configuration folder (`%APPDATA%\apilive` on Windows, `~/Library/Preferences/apilive` on macOS, `~/.config/apilive` on Linux). It records the time of the last update check, the latest version number seen, and whether you have seen the command-line notice. It contains no keys or personal data. You can delete it at any time.
+
+## 3. Information sent to third parties
+
+apilive makes network requests only in these cases:
+
+1. **Checking a key.** When you choose to check a key, apilive sends it to **the API of the provider it belongs to** (for example, an OpenAI key goes only to `api.openai.com`). It uses endpoints that list models or show account or balance details, and never generates content. The provider receives the key, your IP address and standard request metadata, and handles them under **its own privacy policy and terms**. apilive never sends a key to more than one provider. If it can't tell which provider a key belongs to, it asks you.
+2. **Update check.** Once a day at most, apilive asks the public npm registry (`registry.npmjs.org`, operated by GitHub, Inc.) for the latest version number of the `apilive` package. The request contains no keys, usage data or identifiers. Like any web request, it reveals your IP address to the registry operator, which handles it under [GitHub's privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). To turn it off, use any of:
+   - the `--no-update-check` flag
+   - `NO_UPDATE_NOTIFIER=1`
+   - `APILIVE_NO_UPDATE_CHECK=1`
+   - `DO_NOT_TRACK=1`
+
+   It is skipped automatically in CI environments.
+3. **Links you open.** Links to provider dashboards, GitHub or documentation open in your browser like any other link.
+
+The web page itself loads nothing from the internet: no fonts, scripts, images or analytics. A strict Content Security Policy enforces this.
+
+## 4. What the maintainers receive
+
+Nothing. We do not receive keys, results, file contents, device information, usage statistics or error reports. If you contact us, for example by opening a GitHub issue, we receive only what you choose to write. That is handled under GitHub's terms and privacy statement. **Never include real API keys in an issue or message.**
+
+## 5. Legal bases and your rights
+
+Because the maintainers do not collect, receive or store personal data through the software, we are not a data controller or processor for the information apilive handles on your device. That includes processing under the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and India's Digital Personal Data Protection Act, 2023. You stay in control of that information throughout.
+
+AI providers who receive your keys when you check them, and the npm registry operator, are independent controllers under their own policies. To exercise privacy rights over data they hold, contact them directly.
+
+## 6. Children
+
+apilive is a developer tool and is not directed at children under 16.
+
+## 7. Security
+
+We design apilive to keep keys safe on your machine: the local server listens only on `127.0.0.1`, it uses a per-session access token, it rejects requests from other websites, and it has no third-party dependencies. See the [Security Policy](SECURITY.md) for details and for how to report a vulnerability.
+
+## 8. Changes to this policy
+
+If a future version changes how apilive handles information, we will update this policy, change the effective date, and note it in the [Changelog](CHANGELOG.md) **before** that version is released. The policy that ships with the version you run applies to that version.
+
+## 9. Contact
+
+Questions about this policy: open a discussion or issue at https://github.com/parthksingh1/apilive. For sensitive matters, use GitHub's private vulnerability reporting described in the [Security Policy](SECURITY.md).

package/README.md

@@ -0,0 +1,206 @@
+<div align="center">
+
+# apilive
+
+**Are your API keys alive?**
+
+Check LLM API keys for 24 providers in seconds, with latency, models and remaining credit.<br>
+It never makes an inference call, so it costs **zero tokens**. It runs on your machine and has **zero dependencies**.
+
+[![npm](https://img.shields.io/npm/v/apilive?color=34d399&label=npm)](https://www.npmjs.com/package/apilive)
+[![CI](https://github.com/parthksingh1/apilive/actions/workflows/ci.yml/badge.svg)](https://github.com/parthksingh1/apilive/actions/workflows/ci.yml)
+![dependencies](https://img.shields.io/badge/dependencies-0-34d399)
+![node](https://img.shields.io/badge/node-%3E%3D18-3c873a)
+[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+```bash
+npx apilive
+```
+
+<img src="docs/screenshot.png" alt="apilive checking eight API keys: five live with latency, models and credit, one rate-limited, one invalid, one out of credit" width="860">
+
+</div>
+
+---
+
+## Why
+
+You have keys scattered across `.env` files, old projects and password managers. Some are revoked, some are out of credit, and you can't tell which without writing a curl command for each provider.
+
+Online key checkers want you to paste secrets into someone else's website. **apilive runs on your own machine.** Every key goes straight to its own provider's official API and nowhere else.
+
+## Features
+
+- **24 providers**: OpenAI, Anthropic, Gemini, Groq, Mistral, OpenRouter, DeepSeek, xAI, Together, Cohere, Kimi, Qwen, GLM/Z.ai, SiliconFlow, Perplexity, Cerebras, Fireworks, SambaNova, Hugging Face, Replicate, Novita, DeepInfra, Hyperbolic and Nebius.
+- **Zero cost.** It only calls model-list, account and balance endpoints. It never generates a token.
+- **Finds your keys.** It scans `.env`, `.env.local`, `.env.production`… and your shell environment.
+- **Auto-detects the provider** from the key format (`sk-ant-`, `gsk_`, `AIza…`) or the variable name.
+- **More than "valid or not".** Each key is reported as `live`, `invalid`, `no credit`, `rate-limited` or `unverified`.
+- **Shows what the key can do**: latency, available models, and remaining **credit** for OpenRouter, DeepSeek, Kimi, SiliconFlow and Novita.
+- **Paste a whole `.env` file.** It picks out every key, skips placeholders and removes duplicates.
+- **CI-ready CLI** with exit codes and `--json`.
+- **Exports** a Markdown or JSON report with keys masked.
+
+## Usage
+
+### Web UI
+
+```bash
+npx apilive
+```
+
+This opens `http://127.0.0.1:4577`. Any keys found in the current directory's `.env*` files or in your environment are listed but **not sent anywhere until you click Check**. You can also paste one key or an entire `.env` file.
+
+### Terminal
+
+```bash
+npx apilive check                      # scan ./.env* + environment
+npx apilive check .env.production      # specific files
+npx apilive check --no-env             # only .env files, ignore shell env
+pbpaste | npx apilive check --stdin    # from clipboard, stays out of shell history
+npx apilive check --json               # machine-readable
+npx apilive providers                  # list providers + env var names
+```
+
+```text
+  apilive v1.1.0  ·  checking 4 keys  · free endpoints only, no credits spent
+
+  ✓ OpenAI      sk-proj…7Hq2   live · 412ms · 87 models · 4999 req remaining
+                OPENAI_API_KEY · .env
+  ✓ OpenRouter  sk-or-v…2c81   live · 390ms · $13.42 / $20.00
+                OPENROUTER_API_KEY · .env
+  ~ Groq        gsk_DE…Wm4T    rate-limited · 305ms
+                GROQ_API_KEY · .env.local
+  ✗ Mistral     DEMOde…91Lz    invalid · 604ms · Unauthorized
+                MISTRAL_API_KEY · .env
+
+  2 live  ·  1 rate-limited  ·  1 invalid  ·  1.1s  ·  0 tokens spent
+```
+
+**Exit codes:** `0` all keys live (or only rate-limited) · `1` a key is invalid, out of credit, or unverifiable · `2` no keys found or bad usage.
+
+### In CI
+
+```yaml
+# .github/workflows/keys.yml — nightly check that production keys still work
+on:
+  schedule: [{ cron: "0 6 * * *" }]
+jobs:
+  keys:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npx -y apilive@1 check   # pin the major version in CI
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+### Options
+
+| Flag | Description |
+|---|---|
+| `--port <n>` | UI port (default `4577`, falls back to the next free port) |
+| `--no-open` | Don't open the browser |
+| `--no-env` | Ignore environment variables; only read `.env` files |
+| `--stdin` | Read keys or `.env` text from stdin |
+| `-p, --provider <id>` | Treat keys from stdin as this provider |
+| `--json` | JSON output for `check` |
+| `--models` | Print each key's model list |
+| `--timeout <sec>` | Per-request timeout (default `15`) |
+| `--concurrency <n>` | Parallel checks (default `6`) |
+| `--demo` | UI with sample keys and simulated responses, for screenshots |
+| `--no-update-check` | Don't check npm for a newer version |
+
+Other commands: `apilive update` (update in place), `apilive privacy`, `apilive terms`. The [Guide](docs/GUIDE.md) has the full reference, troubleshooting and FAQ.
+
+## Updating
+
+apilive checks the npm registry for a newer version at most once a day and tells you in the terminal and the app. It **never installs anything by itself**.
+
+| How you run it | How to update |
+|---|---|
+| `npx apilive` | `npx apilive@latest` |
+| Global install | `apilive update` (asks, then runs `npm install -g apilive@latest`) |
+
+The check sends one anonymous request to `registry.npmjs.org`, with no keys and no usage data. Turn it off with `--no-update-check`, `NO_UPDATE_NOTIFIER=1` or `DO_NOT_TRACK=1`. It's skipped in CI. Release notes are in the [Changelog](CHANGELOG.md). Releases are published from GitHub Actions with [npm provenance](https://docs.npmjs.com/generating-provenance-statements/), so you can verify with `npm audit signatures` that the package was built from this repository.
+
+## How it stays free
+
+Each provider is checked with an endpoint that **authenticates the key but runs no model**:
+
+| Endpoint type | Providers |
+|---|---|
+| `GET /models` | OpenAI, Anthropic, Gemini, Groq, Mistral, xAI, Together, Cohere, Kimi, Qwen, GLM, SiliconFlow, Perplexity, Cerebras, Fireworks, DeepInfra, Hyperbolic, Nebius |
+| Account / balance | OpenRouter `/key`, DeepSeek `/user/balance`, Novita `/billing/balance`, Hugging Face `/whoami-v2`, Replicate `/account` |
+| Validation-error probe | SambaNova: an embeddings request with no input, rejected before anything runs |
+
+Some providers (Novita, SambaNova, Nvidia, OpenRouter) serve their model list **without authentication**. A naive checker would report *any* string as a working key for them. apilive avoids those endpoints, and `npm run verify` sends a fake key to every provider to prove each one rejects it:
+
+```text
+$ npm run verify
+ok    openai       invalid   401  Incorrect API key provided
+ok    anthropic    invalid   401  API key is invalid.
+ok    gemini       invalid   400  API key not valid.
+…
+No provider accepted a fake key.
+```
+
+> "Live" means the provider authenticated the key. Providers such as OpenAI don't expose credit balance through the API, so a live key can still hit a quota limit on its first real request.
+
+## Security model
+
+apilive handles secrets, so it's built to be easy to audit:
+
+- **No dependencies.** It uses only Node's built-in `http` and `fetch`. The whole backend is about 1,400 lines of plain JavaScript.
+- **Loopback only.** The server binds to `127.0.0.1` and is unreachable from your network.
+- **DNS-rebinding protection.** Requests whose `Host` isn't `127.0.0.1` or `localhost` on the right port are rejected.
+- **Per-session token.** Every API call needs a random token embedded in the page. Other websites can't read it, so they can't drive the local API.
+- **Strict CSP.** `default-src 'none'` with no third-party scripts, fonts or analytics. The page talks only to `127.0.0.1`.
+- **Keys never reach the browser.** The UI receives masked keys (`sk-proj…7Hq2`) and opaque refs. Raw keys stay in server memory and are dropped when you press Ctrl+C.
+- **One key, one destination.** An ambiguous `sk-…` key is **never** tried against several providers, because that would leak it to the wrong companies. You pick the provider instead.
+- **Nothing logged, no telemetry.** Keys are never written to disk. The only file apilive writes is a tiny `state.json` holding the update-check time and whether you've seen the first-run notice. Provider error messages are scrubbed so a key is never echoed back.
+- **Built for your own keys.** There's a limit of 100 keys per session and a first-run notice that you may only check keys you're authorized to use.
+
+See [SECURITY.md](SECURITY.md) to report a vulnerability.
+
+## Add a provider
+
+Providers live in [`src/providers.js`](src/providers.js). Most OpenAI-compatible APIs take six lines:
+
+```js
+{
+  id: "acme",
+  name: "Acme AI",
+  mark: "Ac",
+  keyUrl: "https://acme.ai/keys",
+  env: ["ACME_API_KEY"],
+  pattern: /^acme-\w{20,}$/,           // optional: unique key format
+  regions: ["https://api.acme.ai/v1"],
+  ...openAICompatible(),
+},
+```
+
+Then run `npm run verify` to confirm the endpoint rejects fake keys, and `npm test`.
+
+## Development
+
+```bash
+git clone https://github.com/parthksingh1/apilive && cd apilive
+npm start            # UI (no install step, since there are no dependencies)
+npm run check        # CLI
+npm test             # unit + server security tests
+npm run verify       # live fake-key check against every provider
+```
+
+## Legal
+
+- **Authorized use only.** Only check keys you own or are explicitly authorized to test. Checking leaked or found keys may be illegal. See the [Terms of Use](TERMS.md).
+- **Privacy.** apilive collects nothing and the maintainers receive nothing. See the [Privacy Policy](PRIVACY.md).
+- **Not affiliated.** apilive is an independent project, not affiliated with, endorsed by or sponsored by any provider it supports. Product names are trademarks of their respective owners and are used only to identify services.
+- **No warranty.** apilive is provided "as is", without warranty of any kind. See the [License](LICENSE).
+
+Help: [Support](SUPPORT.md) · [Security](SECURITY.md) · [Contributing](CONTRIBUTING.md) · [Code of Conduct](CODE_OF_CONDUCT.md)
+
+## License
+
+[MIT](LICENSE) © 2026 Parth Kumar Singh

package/SECURITY.md

@@ -0,0 +1,62 @@
+# Security Policy
+
+apilive handles API keys, so we take security reports seriously and appreciate responsible disclosure.
+
+## Supported versions
+
+Only the **latest release** receives security fixes. Update with `apilive update` or run `npx apilive@latest`.
+
+| Version | Supported |
+|---|---|
+| Latest 1.x | Yes |
+| Older releases | No. Please update. |
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security problems.**
+
+Report privately through GitHub's private vulnerability reporting:
+https://github.com/parthksingh1/apilive/security/advisories/new
+
+Include:
+
+- a description of the issue and its impact;
+- steps to reproduce, or a proof of concept;
+- affected version(s), operating system and Node.js version.
+
+**Never include real API keys in a report.** Use obviously fake keys or the `--demo` mode.
+
+We aim to acknowledge reports within a few days, keep you informed while we investigate, and credit you in the release notes if you wish. This is a volunteer project, so timelines are best effort.
+
+## Safe harbor
+
+We will not pursue or support legal action against anyone who, in good faith:
+
+- tests only against their own installation and their own keys;
+- does not access, change or destroy data that isn't theirs;
+- does not degrade services for others, including third-party AI providers;
+- gives us reasonable time to fix the issue before disclosing it publicly.
+
+This safe harbor covers apilive itself only. It does not authorize testing of any AI provider's systems. Their own policies govern that.
+
+## Security design
+
+| Protection | How |
+|---|---|
+| Not reachable from the network | The server binds to `127.0.0.1` only |
+| DNS-rebinding protection | Requests whose `Host` header isn't `127.0.0.1` or `localhost` on the running port are rejected |
+| Cross-site request protection | Every API call needs a random per-session token embedded in the served page, and cross-origin `Origin` headers are rejected |
+| No third-party code in the page | A strict Content-Security-Policy (`default-src 'none'`) blocks external scripts, fonts and trackers |
+| Keys don't reach the browser | The browser gets masked keys and opaque references only |
+| Keys don't reach disk | Keys live in process memory and are cleared on exit, with no logging |
+| No key leakage between providers | Each key is only ever sent to its own provider |
+| Supply chain | Zero runtime dependencies; releases are published from GitHub Actions with npm provenance attestations |
+| Misuse limits | At most 100 keys per session |
+
+### Verifying a release
+
+Releases are published with [npm provenance](https://docs.npmjs.com/generating-provenance-statements/), which links each package version to the exact GitHub commit and workflow that built it. You can verify installed packages with:
+
+```bash
+npm audit signatures
+```

package/SUPPORT.md

@@ -0,0 +1,33 @@
+# Support
+
+apilive is a free, open-source project maintained by volunteers. Support is best effort and has no guaranteed response time.
+
+## Before you ask
+
+1. Read the [Guide](docs/GUIDE.md), especially **Troubleshooting** and **FAQ**.
+2. Make sure you're on the latest version: `apilive update`, or run `npx apilive@latest`.
+3. Run `npx apilive --demo`. If the demo works but your key doesn't, the problem is most likely the key or the provider, not apilive.
+
+## Where to get help
+
+| You want to… | Go to |
+|---|---|
+| Ask a question or share an idea | [GitHub Discussions](https://github.com/parthksingh1/apilive/discussions) |
+| Report a bug | [Open a bug report](https://github.com/parthksingh1/apilive/issues/new?template=bug_report.yml) |
+| Request a new provider | [Request a provider](https://github.com/parthksingh1/apilive/issues/new?template=provider_request.yml) |
+| Report a security vulnerability | Privately, see the [Security Policy](SECURITY.md) |
+| Fix a problem with your key, billing or account | The provider's own support. apilive can't see or change your account. |
+
+## When reporting a problem
+
+Please include:
+
+- your apilive version (`apilive --version`), operating system and Node.js version (`node --version`);
+- the provider, the status apilive showed, and the message in the details panel;
+- the output of `apilive check --json`, **with keys removed**. apilive already masks them, but double-check.
+
+> **Never post a real API key**: not in issues, discussions, screenshots or logs. If you post one by accident, revoke it immediately in the provider's dashboard. Deleting the post is not enough.
+
+## Code of conduct
+
+Everyone taking part in the project's spaces is expected to follow the [Code of Conduct](https://github.com/parthksingh1/apilive/blob/main/CODE_OF_CONDUCT.md).

package/TERMS.md

@@ -0,0 +1,66 @@
+# Terms of Use
+
+**Effective date:** 29 September 2026
+
+These Terms of Use ("Terms") apply to your use of apilive, the open-source software for checking whether API keys are valid ("the Software"). The Software is maintained by Parth Kumar Singh and contributors ("we", "us").
+
+The Software's source code is licensed to you under the [MIT License](LICENSE). Nothing in these Terms limits any right the MIT License grants you to use, copy, modify or distribute the code. These Terms set out the conditions for using the Software's features responsibly and repeat the disclaimers that protect the people who build it. If you do not agree, do not use the Software.
+
+## 1. Authorized use only
+
+You may use the Software only to check API keys that **you own, or that you are explicitly authorized to test** by the owner of the account the key belongs to (for example, your employer's keys, as part of your job).
+
+You must not use the Software to:
+
+- check keys that were leaked, found, scraped, purchased, shared without permission, or otherwise obtained without the account owner's authorization;
+- gain, attempt, or help anyone gain unauthorized access to any account, system or service;
+- break the terms of service, acceptable-use policy or rate limits of any API provider;
+- break any applicable law, including computer misuse and unauthorized-access laws. Examples include the U.S. Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990, India's Information Technology Act, 2000, and their equivalents where you live.
+
+The Software checks a limited number of keys per session and is designed for managing your own credentials, not for bulk testing. You are solely responsible for making sure every key you check is one you are allowed to check.
+
+## 2. Third-party providers
+
+When you check a key, the Software sends a request to that key's provider (for example, OpenAI or Anthropic). That request is made **by you, from your computer, with your credentials**, and is governed by your agreement with the provider. Providers may record, rate-limit or bill for API requests under their own terms. The Software uses endpoints that are normally free, but we do not control provider pricing or behaviour and cannot guarantee that no charge, rate limit or account action will ever result.
+
+## 3. No affiliation; trademarks
+
+apilive is an independent project. It is **not affiliated with, endorsed by or sponsored by** any AI provider or other company named in it. All product names, company names and trademarks, including OpenAI, Anthropic, Claude, Google, Gemini, Groq, Mistral, OpenRouter, DeepSeek, xAI, Grok, Together AI, Cohere, Moonshot, Kimi, Alibaba Cloud, Qwen, Zhipu, Z.ai, SiliconFlow, Perplexity, Cerebras, Fireworks AI, SambaNova, Hugging Face, Replicate, Novita AI, DeepInfra, Hyperbolic and Nebius, belong to their respective owners. They are used only to identify which service a key belongs to. The Software does not use provider logos.
+
+## 4. Results are informational
+
+Results show what a provider's API reported at the time of the check. "Live" means the provider accepted the key for a metadata request. It does **not** guarantee that the key has quota, credit, access to a particular model, or that it will keep working. Credit balances, model lists and rate-limit figures come from providers and may be incomplete, delayed or wrong. Do not rely on the Software as your only control for security, billing or compliance decisions.
+
+## 5. Disclaimer of warranties
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THIS INCLUDES, WITHOUT LIMITATION, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND THAT THE SOFTWARE WILL BE UNINTERRUPTED, SECURE OR ERROR-FREE. YOU USE THE SOFTWARE AT YOUR OWN RISK.
+
+## 6. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE AUTHORS, MAINTAINERS, CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR ITS USE. This includes any direct, indirect, incidental, special, consequential, exemplary or punitive damages, and any loss of data, credentials, profits, revenue, credits or goodwill, API charges, account suspension, or security incident, even if advised of the possibility of such damages.
+
+Where the law does not allow liability to be excluded entirely, the total liability of all such persons combined is limited to **zero (0) US dollars**. The Software is provided free of charge. Some jurisdictions do not allow certain exclusions or limitations, so some of the above may not apply to you. In that case they apply to the fullest extent permitted.
+
+## 7. Indemnity
+
+To the extent permitted by law, you agree to defend, indemnify and hold harmless the authors, maintainers and contributors from any claim, demand, loss or expense (including reasonable legal fees) arising from your use or misuse of the Software, your breach of these Terms, or your violation of any law or third-party right. This expressly includes checking keys you were not authorized to check.
+
+## 8. Updates, support and availability
+
+We may release new versions, change or remove features, or stop maintaining the Software at any time without notice. The Software can check for new versions (see the [Privacy Policy](PRIVACY.md)). Installing an update is always your choice. Support is provided voluntarily, on a best-effort basis, with no guaranteed response time (see [Support](SUPPORT.md)).
+
+## 9. Export and sanctions
+
+You are responsible for complying with all export-control and sanctions laws that apply to your use of the Software and of the third-party services you connect to.
+
+## 10. Governing law
+
+These Terms are governed by the laws of **[JURISDICTION, e.g. India]**, without regard to conflict-of-law rules. Any dispute will be subject to the exclusive jurisdiction of the courts of **[CITY, COUNTRY]**, unless the law of your country of residence requires otherwise.
+
+## 11. General
+
+If any part of these Terms is found unenforceable, the rest remains in effect. If we don't enforce a provision, that isn't a waiver. These Terms, together with the MIT License and the [Privacy Policy](PRIVACY.md), are the entire agreement between you and us about the Software. We may update these Terms, and the version shipped with the release you use applies to that release. Changes are noted in the [Changelog](CHANGELOG.md).
+
+## 12. Contact
+
+Questions about these Terms: https://github.com/parthksingh1/apilive/discussions

package/bin/apilive.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { main } from "../src/cli.js";
+
+const [major] = process.versions.node.split(".").map(Number);
+if (major < 18) {
+  console.error(`apilive needs Node.js 18 or newer (you have ${process.versions.node}).`);
+  process.exit(2);
+}
+
+main(process.argv.slice(2)).then(
+  // exitCode (not exit()) lets pending sockets close cleanly — avoids a libuv
+  // assertion on Windows when exiting mid-teardown.
+  (code) => {
+    process.exitCode = code ?? 0;
+  },
+  (e) => {
+    console.error(e?.stack || e);
+    process.exit(1);
+  },
+);