New AI agents now ask first

Your app's keys.
Safe in one place.

Drop in a certificate, keystore or API key. DevVault reads it and locks it away.

Download for Mac Linux

Free and open source

AuthKey_8G4K2LXQ9R.p8

All items1112 items

Import New Search items, key IDs, fingerprints

NameTypeExpires

APNs auth keyiOS · ProductionAuth key—

Distribution certificateiOS · ProductionCertificateExpired

Firebase configAndroid · ProductionFirebase—

Play publisherAndroid · ProductionService account12 days

Stripe secret keyServer · ProductionSecret—

Upload keystorekitchenly-upload.jksKeystoreJan 2051

Web OAuth clientWeb · ProductionOAuth client—

No item selectedDrop a file anywhere in the window.

APNs auth keyApple Auth Key · iOS · Production

Key ID8G4K2LXQ9R From file

AlgorithmEC P-256 From file

Team IDA1B2C3D4E5

Private key●●●●●●●●

No expiry date in the file.

Drop to import

Import AuthKey_8G4K2LXQ9R.p8 Apple Auth Key · 241 bytes

Details From the file

Key algorithmEC P-256

Key ID8G4K2LXQ9R

NameAPNs auth key

Team IDA1B2C3D4E5A1B2C3D4E5Required · not in the file

Read on this device, stored encrypted.CancelAdd to Vault

File imported

Reads the files you already have

Apple auth keys.p8
Certificates.p12 · .cer · .pem
Provisioning profiles.mobileprovision
Android keystores.jks · .keystore
Firebase configs.json · .plist
Service accountsGoogle Cloud JSON
OAuth clientsclient_secret.json
SSH keysid_ed25519
API keys and secretspaste or type

Never miss
an expiry.

Dates come straight from the file. DevVault reminds you before a certificate or profile runs out.

ExpiryEvery date is from a file or from you

NameExpiresLeftDate from

Distribution certificateApple Certificate4 Oct 20263 days ago From file

Play publisherGCP Service Account19 Oct 202612 days From file

App Store profileProvisioning Profile27 Oct 202620 days From file

Upload keystoreAndroid Keystore14 Jan 205124 years From file

Reminders on · at most two per item

DevVaultnow

“Play publisher” expires soonIt expires on 19 Oct 2026.

AI agents
ask first.

Claude Code, Cursor and others can use a secret only after you click Allow. The value never reaches the model.

claude — ~/kitchenly

> Sign the Android release build
● devvault · run_with_secrets
  ./gradlew bundleRelease -Pstore.password="$STORE_PASSWORD" …
 Waiting for approval in DevVault…
  ✓ Approved once
  > Task :app:signReleaseBundle
  BUILD SUCCESSFUL in 41s
  The passwords went in as env vars. The model never saw them.

“claude-code” wants to run a command with secretsNothing leaves DevVault unless you allow it.

Reason it gave

“Sign the Android release build”

Item

Kitchenly › Android › Upload keystorestore_password · key_password

DenyAllow for 15 MinutesAllow Once

Sync through
your own bucket.

Use Cloudflare R2, S3, Backblaze B2 or MinIO. There is no DevVault server.

The little things, done right.

Key ID8G4K2LXQ9RFrom file

SHA-256FA:C6:17:45:DC:09…From file

Expires14 Jan 2051From file

Team IDA1B2C3D4E5You typed

Facts, not guesses

Every value says where it came from.

Copied30s

Clipboard clears itself

Copied secrets vanish after 30 seconds.

Locks on its own

After 5 minutes without use, or with ⌘L.

5E:8F:16

Upload keystore SHA-1

Search by fingerprint

Or by key ID, bundle ID or name.

sk_live_51Hx…Qa9f2c·a71e·04bd·e3…

End-to-end encrypted

XChaCha20-Poly1305 and Argon2id. Only you hold the key.

Open source

Apache 2.0 with a published vault format. Check every claim on this page yourself.

Get DevVault

Free, open source, and yours to keep.

Download for Mac Linux AppImage

macOS 12+, signed and notarized · Linux x64 · Windows, iPhone and Android are on the way

Your app's keys. Safe in one place.