Store secrets.
Ship with confidence.

Zero-knowledge vault for API keys and credentials — encrypted in your browser, available in your terminal and AI tools. No .env files. No secrets in git.

Service
Environment
Value
OPENAI_API_KEY
OpenAI
Production
sk-proj-••••••••••••••••3a8f
STRIPE_SECRET_KEY
Stripe
Production
rk_live_••••••••••••••••7c2e
ANTHROPIC_API_KEY
Anthropic
Staging
sk-ant-••••••••••••••••9e12
RESEND_API_KEY
Resend
Development
re_9a8B••••••••••••••••4f21

Up and running in minutes

  1. 1

    Create your vault

    Sign up, enable 2FA, and optionally set a custom encryption key.

  2. 2

    Add your keys

    Store API keys by service and environment. Bulk import from .env supported.

  3. 3

    Connect the CLI

    Run apivault login, approve in your browser, and you're paired.

  4. 4

    Ship securely

    apivault run --env Production -- npm start — secrets in memory, not on disk.

Encryption

Encrypted before it leaves your browser.

ApiVault uses AES-256-GCM with keys derived via Argon2id — all in your browser. The server stores only ciphertext. Your master password and raw secrets never touch our servers.

Choose default encryption or bring your own vault key for full zero-knowledge mode.

Create your vault
client-side encrypt
// Derive key from master password
const key = await deriveKey(password)
const sealed = await encrypt(secret, key)
// Only sealed payload is sent
vault.store(sealed)

CLI

Inject secrets at runtime. No .env on disk.

Run any command with secrets loaded directly into process memory. apivault run hides local .env files while your app runs, then restores them automatically. Export to .env when you need it — with owner-only file permissions.

  • apivault login — browser-based CLI authorization
  • apivault keys list / add / reveal / delete
  • apivault env export --env Production
  • apivault config set run.env Production
Install the CLI
# inject secrets and start app
$ apivault run --env Production -- npm start
→ 5 secrets loaded into process.env
ready on http://localhost:3000

AI agents

Scoped access for Cursor, Claude, and MCP tools.

Give coding agents temporary, auditable access to the secrets they need — without checking keys into git or pasting them into chat. Remote MCP with OAuth connects your vault to Cursor and other MCP-compatible tools — approve access once in your browser.

Connect an agent
Auth
Passkeys + TOTP
Environments
Prod / Staging / Dev
Protocol
MCP over HTTP + OAuth

Built for how you actually work

Solo developer

Replace scattered .env files with one encrypted vault. Run local apps with apivault run and never commit secrets again.

AI-assisted coding

Connect Cursor or Claude via MCP. Your agent gets the Stripe or OpenAI key it needs — scoped, revocable, never in chat history.

Multi-environment workflows

Separate Production, Staging, and Development keys. Switch environments with one flag: --env Production.

Security by design, not by promise

Built for developers who actually read the security model.

Client-side encryption

Secrets encrypted in-browser with AES-256-GCM before upload.

Custom vault keys

Optional zero-knowledge mode — only you hold the decryption key.

Passkeys + 2FA

WebAuthn passkeys and TOTP two-factor on every account.

Session management

View and revoke active browser and CLI sessions anytime.

Browser CLI pairing

CLI auth via one-time browser approval — no passwords in terminal.

Masked by default

Keys show masked previews; full values only on explicit reveal.

Start building today.

Free for individuals. Set up your encrypted vault in under two minutes.