Dashboard & Settings
The ApiVault web app is your primary interface for managing encrypted API keys, configuring account security, and reviewing active CLI and MCP connections.
Dashboard
The dashboard is where you create, view, edit, and delete API keys. Each key has:
| Field | Description |
|---|---|
| Name | Identifier used as the environment variable name in CLI run and dotenv export |
| Service | Label grouping keys by provider (Stripe, OpenAI, Custom, etc.) |
| Environment | Logical environment (Production, Staging, Development) — used by CLI --env and MCP list_keys filters |
| Secret value | Encrypted at rest; displayed masked in the UI |
| Notes | Optional free-text notes for your reference |
Keys can be filtered and searched from the dashboard. Reveal operations in the web UI require your vault passphrase when using custom encryption mode.
The top navigation bar provides instant access to Overview and Settings, while the user menu dropdown includes quick links to the Home page, Documentation, and Changelog, alongside theme switching and session logout.
Settings overview
All settings pages require an authenticated session. Access them from the header menu or directly via the routes below.
General
- Display name — your profile name shown in the app
- Email address — primary account email
Security & MFA
- Password — set or change your account password
- Passkeys & biometrics — register WebAuthn passkeys (Touch ID, Face ID, Windows Hello)
- Multi-factor authentication — enable TOTP 2FA with an authenticator app
New accounts may be guided through 2FA setup during onboarding.
Sessions & Devices
- Web & browser sessions — view and revoke active browser logins
- CLI connections & tokens — view and revoke CLI devices authorized via
apivault login
MCP Connections
View AI agents connected to your vault via MCP OAuth. Each connection shows the client name, granted scopes, creation date, and last used time. Revoke any connection you no longer trust.
OAuth Connections
Link or unlink your Google account for single sign-on.
Encryption Key
Configure how your secrets are encrypted. See Security → Encryption for full details on default vs custom modes.
CLI connect flow
When you run apivault login, the CLI opens /cli/connect in your browser. This page shows which device is requesting access and lets you Approve or Refuse. If you are not signed in, you are redirected to login first and then returned to the connect page automatically.
MCP authorize flow
When an MCP client initiates OAuth, you are directed to /mcp/authorize to review the requesting client and select scopes. Approve to issue a scoped access token, or deny to reject the connection.
Environments & services
Environments and services are free-form labels — ApiVault does not enforce a fixed set. Common patterns:
- Environments: Production, Staging, Development, Local
- Services: Stripe, OpenAI, AWS, SendGrid, Custom
Use consistent naming across keys so CLI --env and MCP list_keys filters work predictably.