Agent Key Vault

Let AI agents fetch API keys only after you approve on your phone

Problem

Indie devs have API keys for models and services scattered across their machines. The moment you hand a repo to Claude Code or Codex, those keys risk being pulled into context or written to logs. People are already asking how to keep customer PII out of LLMs, and some have hacked together encrypted phone-based key storage with approval—but the UX is rough, with no iOS push support at all.

Solution

A local-first key vault and approval service: secrets stay encrypted on your machine or phone; when an agent needs one, it calls a single CLI command, which pushes an approval request to your phone. Only after you tap approve does the agent get a short-lived credential. Ships with a gateway, CLI, and a prompt template so agents know when to ask instead of echoing secrets.

Users

Solo devs and small teams running coding agents daily while juggling keys for multiple platforms

MVP

macOS/Linux CLI plus a local daemon only; secrets stored via system keychain or age encryption; one `get-secret` command with TTL and one-time credentials; a web push approval page for mobile; a drop-in instruction file for agents

Revenue

Core open source, team tier per seat with shared vaults, audit logs, and self-hosted deployment; optional paid relay for cloud approval push

Why now

Agents can now read/write files and run commands autonomously, so the leak surface moved from the repo to the agent context—and existing options are either heavy cloud KMS or DIY shell scripts