API Locker

One vault, three types of credentials. Replace your .env file with one token.

API Locker is an encrypted credential vault for developers. Store your LLM API keys, service API keys, and OAuth credentials in one place — then inject them into any command with apilocker run -- npm start. Your raw credentials never touch disk, never live in shell history, never get committed to git.

Free public beta. Try it →

What it does

# Install
npm install -g apilocker

# One-click browser confirmation — no pasted tokens
apilocker register

# Store a credential (for any of 34 provider templates, plus "custom")
apilocker store --name OPENAI_API_KEY --provider openai --key sk-proj-...

# Run any command with your vault secrets injected as env vars
apilocker run -- npm start
#  ↑
#  process.env.OPENAI_API_KEY is populated for the lifetime of this command,
#  then gone. No .env file. Nothing on disk. Nothing in shell history.

That's the whole pitch. Everything else in this repo is making that flow work for every kind of credential a developer has to deal with.

One vault, three types of credentials

API Locker distinguishes three credential types because they're used differently:

apilocker store --name OPENAI_API_KEY \
  --provider openai \
  --key sk-proj-xxxxx

apilocker store --name STRIPE_SECRET_KEY \
  --provider stripe \
  --key sk_live_xxxxx

apilocker store --oauth \
  --name google-oauth \
  --provider google-oauth \
  --client-id ... \
  --client-secret ...

Under the hood, LLM and Service credentials share the same single-string encrypted storage. OAuth is a multi-field encrypted JSON blob. Users experience three product surfaces; implementation shares one foundation.

Why not just use .env files?

Features

• Encrypted vault — AES-256-GCM on every stored credential. Keys never leave the vault in plaintext except when explicitly revealed to an authenticated master-token holder.
• Runtime injection — apilocker run -- cmd injects your vault secrets as env vars for the duration of one command, then clears them.
• Smart proxy — `POST /v1/proxy/:ke

... View full README on GitHub