KeysrsHow to keep API keys out of .env files on a Mac
Why is a .env file risky?
A .env file is plain text. Any program running as you can read it, and so can anything that indexes, syncs or backs up the folder, or a coding agent asked to look around the project. One stray git add . and it is in history.
Where should API keys live on a Mac?
In the macOS Keychain, which stores secrets encrypted and tied to your login. The built-in security command can store a key there and read it back into a single command, which is already better than a file. What it doesn't add is a check that you are the one asking each time.
How do I require Touch ID before a key is used?
Keysrs keeps each key in the Keychain and asks for Touch ID or your login password every time a value comes out: copy, reveal, rotate, delete, or handing it to a command. Every read goes into a per-key audit log. The value never enters its database, its logs or the dashboard.
keys env openai OPENAI_API_KEY -- python run.pygives the key to that one process as an environment variable, so it never touches the clipboard or a file.keys copyputs it on the clipboard and clears it after 20 seconds.keys rotateswaps in a new value under the same name.
How do I give a script or agent a key without handing it over?
Give it a grant instead of the key. keys grant asks for Touch ID once, then prints a short-lived token and a local base URL. The script uses the token where it would put the API key, and the local gateway on 127.0.0.1 swaps in the real key for that one provider host. The grant can be limited to HTTP methods, paths, a request count and a time limit, and it ends when the screen locks. The real key never leaves the Keychain and the app. For a program you keep running, keys client issue makes a longer-lived token with the same kind of scope.
This narrows accidental and unauthorized use on your Mac. It is not a wall against a program that can already read your memory. The README spells out the limits.
I already have a .env file. How do I get the keys out of it?
keys wrap .env finds the values that look like provider keys, asks for Touch ID once, stores each one in the Keychain under a name, and rewrites the file: the key's line now holds a dummy client token, and the matching base URL variable points at the gateway on 127.0.0.1, so the SDK picks both up without a code change. The original is kept beside it as a backup with mode 0600, for you to delete once the program works. A token is bound to one key and its provider, expires after 30 days by default and can be revoked at any time; the real key never needs rotating because of it.
What about a VM or a cloud agent that can't reach my Mac?
Add --relay https://<your worker> and the base URLs point at a small Cloudflare Worker that you deploy into your own account from the repo. Copy the wrapped file to the VM. Its calls reach the Worker, travel down one WebSocket your Mac opened, get the real key swapped in on your Mac and go on to the provider; the Worker never sees a key. The Mac has to be on: a call that arrives while it is away waits up to a minute, then gets a 503 the client can retry.