API Locker

API Locker

One vault, three types of credentials. LLM API keys, service API keys, and OAuth credentials — all encrypted, all injectable into your code with a single command.

API Locker replaces the .env file with one encrypted vault. Store your OpenAI key, your Stripe secret, your Google OAuth client — all in one place — and inject them into any command with apilocker run -- npm start. Your raw credentials never touch disk, never live in shell history, never get committed to git.

This is the command-line interface. Website · Dashboard

Install

npm install -g apilocker

Requires Node.js 18 or newer.

Get started in three commands

# 1. Install the CLI (above)

2. Register this device — opens your browser for a one-click confirmation

apilocker register

3. Run any command with your vault secrets injected as env vars

apilocker run -- npm start

That's it. Your process.env.OPENAI_API_KEY, process.env.STRIPE_SECRET_KEY, process.env.GOOGLE_OAUTH_CLIENT_SECRET — everything you'd normally drop in a .env file — is now injected into the subprocess for exactly the duration of that command. When the command exits, the secrets are gone.

One vault, three types of credentials

🧠 LLM API Keys

OpenAI, Anthropic, Gemini, Groq, Mistral.

apilocker store --name OPENAI_API_KEY --provider openai --key sk-proj-xxxxx

apilocker run -- node my-ai-app.js

⚡ Service API Keys

Stripe, Twilio, Resend, ElevenLabs, Cloudflare, GitHub, Clerk, Sentry, PostHog, Cloudinary, Mux, SendGrid, Vercel, Upstash, LemonSqueezy — plus custom for anything else.

apilocker store --name STRIPE_SECRET_KEY --provider stripe --key sk_live_xxxxx

apilocker run -- npm start

🔗 OAuth Credentials

Google, GitHub, Slack, Microsoft, Notion, Spotify, Twitter/X, LinkedIn, Discord, Zoom, Dropbox, Salesforce, HubSpot — plus custom OAuth for anything else.

apilocker store --oauth \

--name google-oauth \ --provider google-oauth \ --client-id 856449...apps.googleusercontent.com \ --client-secret GOCSPX-xxxxx \ --scopes "openid email profile"

Injects GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, etc.

apilocker run -- node oauth-app.js

The full command set

The .apilockerrc file

Pin a project to a specific set of credentials with a committable config file. apilocker init walks you through creating one:

# .apilockerrc — safe to commit to git, contains only pointers

keys:

• OPENAI_API_KEY
• STRIPE_SECRET_KEY
• google-oauth

After apilocker init, anyone cloning your repo who runs apilocker run -- npm start gets the same env vars — assuming they have access to those aliases in their own vault. It's like a package.json for credentials: the file declares what the project needs, each developer has their own vault.

Why the CLI doesn't ask for a pasted master token

Unlike most developer tools, apilocker register doesn't want you to paste a secret from the dashboard. Instead:

1. You run apilocker register
2. Your browser opens to a single-card confirmation page
3. You click "Authorize"
4. The CLI receives a per-device master token over an authenticated polling channel — it never touches your clipboard, shell history, or screen

This is the RFC 8628 device authorization flow (the same pattern gh, vercel, wrangler, flyctl, and gcloud use). It's strictly safer than pasted tokens because the secret never appears anywhere a human can accidentally leak it.

New users? The same flow handles signup — your first OAuth click with GitHub/Google creates the account automatically. No separate visit to the web portal required.

MCP integration — connect your AI assistant

API Locker exposes a full Model Context Protocol server with 25 tools so Claude Code, Claude Desktop, Cursor, Zed, Continue, and any other MCP-compatible client can read and manage your vault directly.

Claude Code — one command

claude mcp add apilocker -- apilocker mcp

Verify with claude mcp list. You should see apilocker: apilocker mcp - ✓ Connected. The server is available in your next Claude Code session automatically.

Claude Desktop, Cursor, Zed, Continue

The CLI ships with apilocker mcp — a stdio bridge that handles the connection automatically. Configure any MCP client with:

{

"mcpServers": { "apilocker": { "command": "apilocker", "args": ["mcp"] } } }

The bridge reads your master token from ~/.apilocker/config.json automatically. No credentials go in the client config itself.

Print client-specific config with the built-in helper:

apilocker mcp config --client claude-desktop   # or claude-code, cursor, continue, zed, generic

Full docs: https://www.apilocker.app/docs/mcp — includes config file locations for each client, troubleshooting, and the full 25-tool catalog.

Visual status: the dashboard has a dedicated MCP panel at https://www.apilocker.app/dashboard#mcp showing server status, a test-connection button, copy-pasteable config for every major client, and a live feed of recent MCP activity.

Security posture

• AES-256-GCM encryption on every stored credential. Keys never leave the vault in plaintext except when revealed to an authenticated master-token holder (you).
• Per-device tokens with independent revocation. Stolen a laptop? Revoke that one device; every other device keeps working.
• OAuth CSRF protection with state tokens bound to a 10-minute KV window.
• Strict file permissions (0600) on ~/.apilocker/config.json.
• Audit-logged everywhere: every reveal, every proxy call, every rename, every rotation. Watch them live with apilocker activity --follow.
• Lossless rename with previous_names fallback: renaming a credential never breaks existing code. Old aliases transparently resolve to the current credential with a gentle nudge to update configs.
• Pause/resume to freeze proxy access during incident response without losing the credential itself.

Configuration

Config lives at ~/.apilocker/config.json (mode 0600). Don't check it in.

Override the API endpoint for self-hosted deployments:

apilocker register --url https://api.your-locker.example.com

Status

API Locker is free to use with unlimited keys, unlimited tokens, and unlimited proxy calls. Early adopters get grandfathered into free Pro permanently when paid plans launch.

Links

• Website: www.apilocker.app
• Dashboard: www.apilocker.app/dashboard
• API: api.apilocker.app
• Changelog: www.apilocker.app/changelog

License

MIT © 2026 API Locker