Setting your key

Route: Settings → AI key (BYOK)

Tostada's AI features are bring-your-own-key. You paste an Anthropic API key once; it lives in your browser's localStorage and is used directly when Tostada talks to Anthropic. There's no Tostada server in the middle.

Getting a key

Go to console.anthropic.com
Sign in (or sign up) for an Anthropic account
Open Settings → API Keys
Create Key; copy the value (starts with sk-ant-…)

Pasting it into Tostada

Open Settings (top nav, gear icon)
In the AI key (BYOK) section, paste the key into the Anthropic API key field (placeholder: sk-ant-…)
Click Save

The button briefly shows Saved. The key is now in localStorage under the key tostada-ai-key.

Masked re-display

After saving, the input shows a masked version (first 6 + last 4 characters) so you can confirm a key is present without exposing it on screen.

To replace it, paste a new key over the masked value and click Save again.

Clearing the key

Clear the input and click Save with an empty value. The key is removed; AI features fall back to stub mode (deterministic mock responses so the flows are still testable).

What unlocks once a key is present

Today: Ask AI: generate tokens on the Primitives editor — see ask-ai-tokens.

Roadmap (deferred):

Suggest layout principles from a description
Apply your design system to fetched pages (real Spread)
Drop a screenshot, get a token patch (multimodal)
Component scaffold from a prompt

See REBUILD_PLAN.md → M7.

Why BYOK

Tostada is local-first. We don't want to know what you're building, and we don't want to be liable for your API spend. BYOK keeps the trust model simple: you pay Anthropic directly, you control the key, you can rotate it any time.

Where the call goes

Direct from your browser to api.anthropic.com using the official Anthropic SDK in browser mode. Anthropic returns the response, Tostada renders the diff, you click Apply. No Tostada server sees the prompt, the response, or the key.

See privacy for details.