Zero-Telemetry Development: The Architecture of Local Keychains

Local Keychain Architecture

Most cloud-based AI coding tools route developer tokens through proprietary intermediaries for tracking, rate limiting, and analytics. For enterprise teams and privacy-conscious engineers, this represents an unacceptable compliance vulnerability.

CodeXa Studio utilizes the operating system's native cryptographic vault: Windows Credential Manager, macOS Keychain Services, and Linux Secret Service API (via libsecret). Keys never touch CodeXa Agency servers.

// Direct Hardware Keychain Read
import { getSecret } from "@codexa/keychain";

export async function getProviderClient(provider: "anthropic" | "openai" | "google") {
  const secretKey = await getSecret({
    service: "codexa-studio-ide",
    account: `byok-${provider}`,
  });

  return new DirectProviderClient({
    apiKey: secretKey,
    directEndpoint: true, // No intermediary proxy
  });
}

Direct Client-to-Provider Transit

When you run queries in Bring-Your-Own-Key (BYOK) mode, outgoing HTTPS requests originate directly from your local network to the AI provider endpoint with TLS 1.3 encryption.

Air-Gapped Telemetry Policy

CodeXa ships with zero telemetry by default. Crash reports and usage metrics require manual opt-in. In offline mode with the NEXA Edge model, internet access is completely unneeded.