I Built EnvVault to Keep API Keys Out of .env Files

Short summary

EnvVault is a local-first secret manager that keeps API keys out of .env files by storing references like envvault://openai/dev instead of raw credentials, resolving them from the OS credential store at process launch. It includes optional proxy mode to avoid passing real keys to child processes and integrates with agent tools. While not a sandbox or production secret manager, it reduces accidental credential exposure in project directories.

• •EnvVault stores API key references in .env instead of raw credentials, keeping secrets in OS credential store
• •Resolves credentials at process launch via envvault exec command
• •Optional proxy mode prevents passing real keys to child processes when API SDK supports custom endpoints

Generated with AI, which can make mistakes.