Getting started

Install

Download the DMG from keykeeper.dev, drag KeyKeeper into Applications and open it. It lives in the menu bar. Apple Silicon, macOS 14 or later; signed and notarized. In the app, install the command line (keykeeper) with one click under Settings → Command line.

Tell your agent

Codex and Claude Code pick KeyKeeper up through its skill: point them at skill/keykeeper.md, or just say "use KeyKeeper for API keys". From then on, when a task needs a key, the agent runs the KeyKeeper flow instead of asking you to paste one.

The first key

Say what you want done — "help me set up Stripe refunds". The agent finds the Stripe template, opens the key page for you, and tells you what to pick. You log in and copy the key. A window appears:

• Save as stripe · stripe-api-key
• Provider Stripe — checked after saving with a read-only request to api.stripe.com
• Declared use what the agent says the key is for

Click Save. KeyKeeper stores the key in the Keychain, verifies it with Stripe, and the agent continues. It has not seen the value at any point.

Already have a .env?

keykeeper import ./.env --id my-app

KeyKeeper shows you the variable names it found and, once you approve, moves the secrets into the Keychain — including ordinary settings, so no secret is accidentally left in plain metadata. Then keykeeper run -c my-app -- npm run dev injects the imported variables. Empty, reserved or unsupported names are skipped; malformed/multiline syntax is refused and shell interpolation is not performed. Review skipped variables and delete the file only when everything runs, and rotate keys that were sitting in plaintext.

The first approval

When the agent runs a command that needs the key, an approval window shows who is asking, what it says it is doing, and KeyKeeper's own one-line verdict. Answer just this once, while it runs, or don't ask again. See Approvals.