An Encrypted API Key Vault Built for Developers

Generic password managers were designed for website logins. API keys break their assumptions: they're long opaque tokens, they rotate on a schedule, they belong to environments not sites, and a single leaked key can drain an AWS account in hours.

PassCryp's API Key Vault adds the missing structure. Each entry has a provider (so the UI knows what fields matter), an environment tag, an expiry date, and an owner. The vault knows the difference between a Stripe sk_live_ and an sk_test_; it warns you before a token expires; it groups keys by project so handoffs are clean.

Underneath, the encryption is the same as the rest of PassCryp: AES-256-GCM with Argon2id, client-side, zero-knowledge. We see ciphertext only.

Open the vault, click New API Key, and pick a provider. The form auto-shapes — AWS gets Access Key ID and Secret Access Key fields; Stripe gets a single secret with live/test detection; OpenAI gets an org ID and key.

Set an expiry date or leave it open. Tag the environment. Add a note describing scope. Click Save — the key encrypts client-side and uploads as a ciphertext blob. From any other device, unlock the vault and the key is there, ready to reveal.

When the expiry date is 7 days away, you get an in-vault badge and an optional email. After the date passes, the key is marked stale and surfaced at the top of the vault until you rotate it.

Every dev has done it: a .env file checked in by accident, an API key pasted in Slack, a secret hard-coded in a notebook. PassCryp gives you one place these belong, with an extension that surfaces the right key on the right domain so you don't fall back to copy-pasting.

Combined with the included pre-commit hook in the docs, you can detect committed keys, rotate them in PassCryp, and update your deployment environment without ever putting plaintext in your terminal history.