The RSS link follows the selected product. Subscribe to the CLI feed, MCP Server feed, Web App feed, or the combined feed. Feeds now include release banners, video posters, and links to watch videos.

Release articles and feeds use the same Markdown block parser for tables, nested bullets, callouts, and media. Product selection and image previews support keyboard controls, and release navigation leaves media controls and open dialogs in charge of their arrow keys.

Find recent updates on the documentation home.

New and split pages include:

• CLI commands: config, env, keys, login, logout, logs, projects, run, and whoami each have a page with usage, flags, and examples, alongside guides for project linking and global options.
• Reference: a REST API overview and Endpoints reference, Core concepts, Error codes, Limits, and Troubleshooting & FAQ.
• Focused guides: one guide per integration provider, MCP client setup and tools, Projects & RBAC, Audit logs, User settings, Encryption, Authentication & limits, GitHub Actions, and Docker & Kubernetes.

Docs search now indexes page sections and ranks title matches first.

Key update responses

PUT /api/keys/{id} now returns the same masked response as GET /api/keys/{id}, and no longer includes key_encrypted, iv, or other internal fields.

Start from the documentation home, or see the endpoints reference.

You can now sync a project's keys to GitHub Actions, alongside Vercel, Supabase, and Cloudflare. Each ApiVault environment maps to a repository's secrets or to a named deployment environment.

To get started:

1. Open your project's Integrations page and select Connect GitHub.
2. Choose the GitHub account or organization to connect, and install ApiVault's GitHub App on the repositories you want to sync.
3. Link a repository and map each ApiVault environment to its repository secrets or to a deployment environment.

A mapping can name a deployment environment that doesn't exist yet. ApiVault creates it under the exact name you typed, and the sync preview lists it before anything is created.

Changes made on GitHub

GitHub reports when each secret last changed, so ApiVault can tell when a secret it manages was edited there:

Unlinking or disconnecting still removes everything ApiVault owns.

Connections and credentials

ApiVault keeps only the installation ID and mints a short-lived token for each sync run. Reconnecting stays on the connection's own account, and reinstalling the app carries your repository links across instead of creating a second entry.

Sync errors now withhold a provider's message if it quotes a secret value, including in an escaped or URL-encoded form. This applies to GitHub, Vercel, Supabase, and Cloudflare.

Learn more in the GitHub integration guide.

Three changes also address requests that fail after a connection has been idle:

• Connection lifetimes: connections are replaced after 5 minutes, idle connections close after 60 seconds, and the pool resets after a pause longer than 4 minutes.
• Read retries: a read retries once on a fresh connection if the database closed an idle socket. Writes are not retried automatically, avoiding duplicate write attempts.
• Status checks: database health checks use a dedicated connection instead of resetting the shared request pool.

Check real-time health on the status page, or review error resolutions in troubleshooting.

Incident tracking

Each incident has a detail page with timestamped updates. Uptime bars reflect measured availability and reported incidents. During an active outage, the page checks again every 30 seconds to detect recovery.

Vulnerability disclosure

A new security page and standardized /.well-known/security.txt describe our encryption model, disclosure scope, safe harbor policy, and response timeline.

Learn more about system health and diagnostics in troubleshooting.

Watch video: Generated avatars preview in ApiVault

Accounts and projects now receive a generated avatar, shown in the navigation header, project switcher, member lists, and invitations. Use the regenerate button in General Settings or Project Settings to get a different design.

Account email updates

Verification and password reset emails now include the 6-digit code in the subject line, so it can appear in inbox notifications. The email body shows the code in a monospaced block, with styles for light and dark mail themes.

Password reset requests for unregistered addresses now send an account-not-found email with an invitation to register, rather than a code box reading NO ACCOUNT.

Learn more in the user settings guide.

You can now sync a project's keys to Cloudflare Workers.

To get started:

1. Open your project's Integrations page and connect Cloudflare.
2. Approve one or more Cloudflare accounts.
3. Map each ApiVault environment to a Worker's Production secrets, Previews secrets, or Workers Builds variables.

Choose the right target

Warning: Build variables are available to your bundler and can be included in public client-side code. Map only the keys the build needs. Build targets start unselected, and targets unavailable for a Worker are disabled with an explanation.

Syncs run automatically when keys change, on the retry sweep, and from Sync now, which shows a full diff preview. Production secret changes are batched into a single new Worker version deployment.

What ApiVault changes

ApiVault only modifies or deletes the secrets it created on each target. Existing secrets or bindings with the same name are reported as conflicts, and values over 5 KiB are skipped.

Connecting more accounts under the same login adds them alongside existing connections without revoking access to linked Workers, and unused OAuth grants are revoked immediately.

Audit logs and exports record the Cloudflare account, Worker, and deployed version count, and you can filter them with ?integration=cloudflare.

Learn more in the Cloudflare integration guide.

Non-owner members can now leave a project from a new Leave Project section in Project Settings. If an owner tries to leave, it links to Transfer Ownership.

Vault Encryption

The Vault Encryption page now has a single Use your own vault key switch, with real-time key length and confirmation checks. It also offers a way to recover if encryption settings fail to load.

Fixes

• Changing a project's slug now redirects to /<owner>/<new-slug>/settings instead of a broken /user/... URL.
• Username suggestions on sign-up work again.

Learn more in the projects guide.

You can now sync a project's keys to Supabase Edge Function secrets.

To get started:

1. Open your project's Integrations page and connect a Supabase organization.
2. Link a Supabase project.
3. Choose an ApiVault environment to sync. Keys sync automatically when they change, or on demand with Sync now.

ApiVault only modifies or deletes the secrets it created. Existing secrets with the same name are reported as conflicts, and keys beyond Supabase's 100-secret limit are flagged without failing the sync.

Sharing a team or organization across projects

Several ApiVault projects can now connect to the same Vercel team or Supabase organization. Each project only changes the variables it manages, and the shared authorization stays active until the last project disconnects.

Audit logs

Audit logs now have an Integration source, filters for Vercel and Supabase, and sync and cleanup details.

Fixes

• Projects with no keys yet now offer Production, Staging, and Development when mapping environments.
• Disconnecting or unlinking after access was revoked now immediately offers Remove anyway.

Learn more in the Supabase integration guide.

You can now keep a Vercel project's environment variables synchronized with your ApiVault keys directly from the new Integrations catalog.

To connect your project:

1. Open Integrations in your project and select Connect Vercel to authenticate a personal account or team.
2. Select your target Vercel project.
3. Map your ApiVault environments to Vercel's Production, Preview, or Development targets.

Keys sync automatically whenever secrets are created, updated, deleted, or imported. Transient network errors retry with exponential backoff, and optional production redeployments can be triggered on sync.

Safe diff preview

Before applying any sync, an interactive diff preview details variables to be created, updated, removed, or flagged in conflict. Variables created natively in Vercel are never overwritten or deleted.

Learn more in the Vercel integration guide.

The homepage also has an FAQ covering secret decryption, custom vault key recovery, apivault run, AI agent OAuth scopes, and CI/CD service tokens.

Browse all topics in the documentation.

The catalog now covers 34 services plus Custom, with brand logos and badge colors adjusted for your theme. New services include DeepSeek, Groq, Mistral, Pinecone, Qdrant, Together AI, LangChain, ElevenLabs, xAI, OpenRouter, Perplexity, Hugging Face, Cloudflare, Vercel, and Twilio.

MCP client icons

MCP dynamic client registration now accepts HTTPS logo_uri and client_uri values. The consent screen and settings resolve a client's icon from its registered logo, its favicon, or a matching brand icon.

Learn more about service detection.

Fixes & routing

• Reserved usernames: names generated during Google sign-in are checked against reserved route names (such as docs, settings, and dashboard) and 3–30 character length constraints.
• Dashboard aliases: /dashboard/logs, /dashboard/members, /dashboard/tokens, /dashboard/encryption, and /dashboard/settings now forward directly to the matching tab in your active project.
• 404 handling: unmapped /settings/* and /docs/* routes return a proper 404 screen.

Learn more in the projects guide.

Create one from the new Service Tokens page in your project. The raw token is shown once and stored only as a SHA-256 hash. Pass it to the CLI as APIVAULT_TOKEN:

APIVAULT_TOKEN=av_live_... apivault run -- npm run build

Limit what a token can do

• Scopes: list keys, reveal decrypted values, and modify keys are separate grants, capped by the role of whoever creates the token.
• Environment pin: a pinned token can only read and write that environment, and callers can't override the pin.
• IP allowlist: restrict a token to IPv4 or IPv6 CIDR ranges. Requests from anywhere else, or from an unknown address, are refused.
• Expiry: every token expires after 7 to 365 days, 90 by default. There is no option for a token that never expires.

If a token leaks or its creator leaves

Service tokens reach key endpoints and nothing else. Project settings, members, invitations, encryption configuration, and token creation all reject them.

Warning: Removing a member does not revoke the service tokens they created. These credentials belong to the project and keep working until revoked or expired. The Service Tokens page flags tokens whose creator has left.

To revoke a token, open the project's Service Tokens page, find it, and choose Revoke. Owners and admins can revoke tokens; revocation takes effect immediately. Revoke a leaked token immediately, then replace it in any affected pipelines. For routine rotation, update the pipeline's CI secret with a replacement before revoking the old token.

Audit logs record token requests and refusals under their own Service source, with a filter for each token. Project owners and admins are notified when a token exports an entire environment.

Learn more in the service tokens documentation.

Accessibility updates

• Form labeling: fields across sign-in, registration, password reset, and vault key entry are linked to explicit labels. Error and success states are announced to assistive technologies.
• Checkboxes: conflicting nested labels have been eliminated, and indeterminate states are properly reported.
• Keyboard focus: controls have visible focus rings, and the site includes a skip-to-content link and main landmark.
• Visual styling: respects reduced-motion preferences, light-mode colors satisfy 4.5:1 contrast, and touch targets meet 44px minimum sizing.

MCP consent verification

The MCP authorization screen shows the redirect URI origin and marks client names as unverified. Names supplied through dynamic registration can be claimed by anyone, so review the redirect destination before authorizing a client.

Learn more about the interface in the Web App guide.

Additional security updates

• Content Security Policy: all responses include a nonce-based policy with strict-dynamic, along with Strict-Transport-Security.
• Expiring CLI tokens: newly approved CLI device tokens expire after 90 days.
• Audit logs: failed and denied key attempts—such as invalid vault keys, throttled reveals, and read-only refusals—are recorded with HTTP status and attempted event type.

API improvements

The X-Project-Id header, projectId query parameter, and project log endpoints now accept project slugs as well as string IDs. The log API also filters by explicit status codes and log ID prefixes.

Learn more in the limits reference.

The drawer has All and Unread filters, links to the affected resources, and controls to mark notifications as read or clear them. Notifications are also available through GET /api/user/notifications.

Learn more in the user settings guide.

Select an entry to open a detail drawer with the request path, network classification, IP address, latency, AI agent or client, OAuth scopes, and JSON payload.

Filtering and exports

The sidebar filters by event type, source, HTTP status, and specific API key, with per-key event counts and presets for 1h, 24h, Today, 7d, and 30d.

Export logs as CSV, JSON, or Elastic Common Schema (ECS / NDJSON). Exports include SHA-256 checksums and support time-range presets and your active filters.

Learn more in the audit logs guide.

The preview switches between two formats:

• .env file: download or copy it, with a toggle to mask or reveal values.
• CLI commands: copy ready-to-run commands instead of writing a file.

Learn more about projects and keys.

Existing project members have been automatically migrated to the Editor role. Roles can be adjusted at any time from the Members page.

Server-side enforcement

All key mutation routes—including bulk imports—and MCP tools reject write attempts from Viewers with 403 Forbidden. Remote MCP tokens are validated against active project membership before every key read, reveal, or write.

Learn more in the Projects & RBAC guide.

Accounts can now have multiple projects, each with its own keys, members, and encryption settings. Project URLs use /<username>/<project-slug>, with separate pages for members, encryption, and settings.

The sidebar includes a project switcher and links to those pages. Registration asks for a unique username; Google sign-up creates a username and a Personal project.

Per-project encryption

Each project can use a different custom vault key. Cached vault keys and decryption requests are scoped to the selected project. Reset Project in Project Settings clears the project's secrets and encryption settings while keeping the project.

Learn more in the projects guide.

Custom vault keys are now sent Base64-encoded in the X-Vault-Key-B64 header, so non-Latin characters and symbols work in every browser.

Sign-in and sessions

• Password resets: resetting a password now revokes browser sessions, CLI tokens, and MCP authorizations.
• Google accounts: sign-in and registration are separate flows, which prevents accidental account creation. Sign-in and account linking require explicit, verified account states.
• Two-Step Verification: the screen shows only the methods active on your account, and disabling 2FA requires your password or an authenticator code. Existing passkeys can be enabled for 2FA with one click during onboarding.
• Account privacy: MFA method discovery no longer reveals whether an account is enrolled.

Request protection

ApiVault now has same-origin mutation protection and baseline browser security headers. Email verification routes are guarded, and anonymous CLI connection requests are rate limited.

Learn more in the authentication guide.

Codes are stored as SHA-256 hashes and expire after 10 minutes. You can request a new one after 60 seconds, and an incorrect code locks after 5 attempts.

On mobile, code fields open a numeric keypad and support one-time code autofill. Authentication pages also now work with password managers.

Learn more in the authentication guide.

Caution: Account deletion is immediate and irrevocable. It permanently wipes your encrypted API keys, custom encryption settings, passkeys, TOTP secrets, active web sessions, CLI tokens, and MCP OAuth grants.

The Privacy Policy and Terms of Service have been updated to detail cryptographic handling, passkey data retention, and granted AI agent OAuth scopes.

Support and security notices are now consolidated under support@apivault.tech.

Learn more in the user settings guide.

Pages now feature OpenGraph and Twitter cards, along with Schema.org structured metadata for the application and organization.

Canonical URLs, CLI defaults, MCP server endpoints, and documentation references now consistently use https://apivault.tech and https://mcp.apivault.tech/mcp.

Browse all features in the documentation.

Mobile sessions

Settings → Sessions & Devices now identifies iOS and Android browsers correctly, including Mobile Safari, Chrome iOS, Firefox iOS, Edge Mobile, and Samsung Internet. It shows the right operating system and a smartphone or tablet icon.

Learn more in the user settings guide.

Filter by status or category, search for an item, and open it to read its technical deliverables. Each item has a shareable link using ?item=<id>.

Start exploring ApiVault with Getting started.

Execution modes

• Demo sandbox: an in-memory test environment to safely explore CLI command syntax.
• Live Vault: authenticates against your account to run whoami, keys list, keys get --reveal, keys add, keys update, and keys delete.

apivault keys list --env production
apivault keys get 1 --reveal --vault-key "my-secure-vault-key"

The shell features command autocomplete, quote-aware argument parsing, interactive field prompts, and inline copy for --json payloads.

Learn more in the CLI documentation.

Search titles, summaries, and article text from the timeline, or filter updates by Web App, CLI, and MCP Server. Release pages also include links to ask ChatGPT, Claude, or Perplexity about an update, plus a button to copy an AI prompt.

Learn more about ApiVault in the documentation.

Redesigned documentation layout

• Installation selector: choose between npm, npx, and standalone install scripts.
• Responsive navigation: a mobile drawer, plus a table of contents that highlights your position on the page as you scroll.
• Step-by-step walkthroughs: numbered steps for getting started and setting up MCP clients.

Sidebar auto-scrolling when switching between documentation pages was also resolved.

Explore the updated guides in the documentation.

ApiVault is now available: a vault for storing encrypted API keys, organizing them by environment, and managing access from a web dashboard.

• Encryption at rest: key values are encrypted on the server with AES-256-GCM before reaching the database. Default mode uses server-managed keys; custom mode derives the encryption key from a vault key you supply, which ApiVault does not store.
• Environments: separate Development, Staging, and Production keys, with service tags.
• Sign-in: passkeys, TOTP two-factor authentication, and Google OAuth.

Learn more in Getting started.