Now in public beta

One vault for
every API key.

Encrypted storage, a smart proxy, and AI-agent access — all without ever exposing your credentials to the apps that use them.

~/projects/my-app — apilocker
$ apilocker register
Device fingerprint generated · master token saved
$ apilocker store openai sk-proj-••••••••••••••••••••
Key encrypted · stored in vault · provider: openai
$ apilocker token --scope openai --rotate daily
Scoped token issued · rotates every 24h
$ curl https://api.apilocker.app/v1/openai/chat/completions ...
Features

Built for how you ship.

A quiet layer between your apps and the APIs they call. Encrypted, observable, and invisible by default.

Encrypted vault

Your keys, locked behind device-bound auth.

Every credential is encrypted at rest with a master token bound to your machine. Rotate on a schedule, issue scoped tokens per project, and revoke instantly — without touching the underlying key.

vault.enc
openai
sk-proj-••••
anthropic
sk-ant-••••
stripe
sk_live_••••
supabase
eyJhbG••••
resend
re_••••
cloudflare
••••••
Smart proxy

Stream responses without exposing the key.

Your app hits the proxy. The proxy injects the real credential, forwards to the provider, and streams the response back — SSE and all. Your raw key never leaves the vault.

proxy.request
1 Receiving inbound request
2 Validating scoped_token
3 Injecting api_key from vault
4 Forwarding to provider
5 Streaming response
MCP ready

Built for AI agents from day one.

Expose your vault to Claude, Cursor, or any MCP-compatible client. Agents call real APIs without ever seeing the underlying credentials — and every call is logged, scoped, and revocable.

.mcp.json
{
  "mcpServers": {
    "apilocker": {
      "command": "apilocker",
      "args": ["mcp", "serve"],
      "scope": "openai,anthropic"
    }
  }
}

Your keys.
Your proxy.
Your control.

Install the CLI in under a minute. Free while in beta — no credit card, no signup.