Recent updates, release notes, and version history across ApiVault products.
Changelog search and product filters now stay in the URL, and each product has its own RSS feed. Release pages and feeds share Markdown parsing and include release media.
The documentation now has task-based sections, a page for every CLI command, and new reference pages. PUT /api/keys/{id} also no longer returns internal fields.
The CLI's source now lives at github.com/ApiVault-tech/apivault.
Keep a project's keys in GitHub Actions as repository or deployment environment secrets, and see when someone changes one of them on GitHub.
Server functions now run in the same region as the database, idle connections are replaced before they go stale, and reads retry once if a connection was closed.
New public pages show live service status, 90 days of incident history, and how to report a security vulnerability.
Accounts and projects get a generated avatar you can regenerate in settings, and verification and password reset emails now include the code in the subject line.
Keep a Worker's Production secrets, Previews secrets, and Workers Builds variables in sync with your project's keys.
The desktop sidebar can now be collapsed, members can leave a project from Project Settings, and Vault Encryption has a simpler setup.
apivault logs --source help now includes service and integration.
Push a project's keys into Supabase Edge Function secrets, share one Vercel team or Supabase organization across projects, and filter audit logs by integration.
apivault run and env export now follow a service token's environment pin, and no command hangs on a prompt when there is no terminal.
Connect a project to Vercel from the new Integrations catalog and keep its environment variables in sync, automatically or on demand with a diff preview.
Every changelog release and documentation page now generates its own social card, and the homepage answers common questions in a new FAQ.
ApiVault now recognizes 34 services from a key's name or secret prefix, shows their logos, and resolves icons for registered MCP clients.
A project you can't access now shows the same screen whether or not it exists, reserved route names are enforced at sign-up, and /dashboard/* links reach your active project.
Projects can now issue scoped, expiring credentials for CI/CD pipelines, optionally limited to one environment and a set of IP ranges.
The CLI now authenticates from APIVAULT_TOKEN, so apivault run works in a pipeline with no browser and no stored device token.
Dialogs trap focus, form fields have real labels, the MCP consent screen shows where it will send you, and the landing page stops downloading an image it never shows.
The new apivault logs command lists, filters, inspects, and streams a project's audit and request logs.
The CLI now knows when a device's token expires, warns you before it does, and explains rejected requests instead of printing a bare "Unauthorized".
Incorrect vault keys are now limited to 10 attempts per 15 minutes on every MCP tool that accepts one.
Failed sign-ins and vault keys are now rate limited across web, CLI, and MCP, with a strict Content Security Policy, expiring CLI tokens, and failed requests in the audit log.
A new notification center in the user menu shows project invitations, security events, CLI and MCP authorizations, and system updates.
Project bindings and CLI settings can now live in your project directory, so you no longer switch projects when you change directories.
A new Request & Audit Logs page tracks key activity across web, CLI, and MCP, with Live Tail, a detail drawer, and CSV, JSON, and ECS exports.
apivault keys get --reveal no longer fetches the key twice.
Export any environment's keys from the dashboard as a .env file, or copy ready-to-run CLI commands.
Projects now have Owner, Admin, Editor, and Viewer roles, enforced on the server across REST and MCP, and owners can transfer a project.
apivault keys get, update, and delete no longer download your full key list.
A new apivault projects command group and a global --project flag let the CLI target any of your projects.
MCP connections can now be bound to one project when you authorize them, limiting that agent to that project's keys.
Accounts can now have multiple projects, each with its own keys, URL, members, and vault encryption settings.
The MCP handshake, health endpoint, and server card now all report the same package version.
Vault rotations now update in one transaction, custom vault keys support any character, and sign-in, 2FA, and session handling have been hardened.
ApiVault now sends one-time codes for email verification and self-serve password resets.
You can now permanently delete your account from Settings, and the Privacy Policy and Terms of Service have been expanded.
The CLI's default API URL and standalone install scripts now use the production domain.
Default URLs and setup commands now use the production MCP endpoint, with RFC 9728 metadata verified across endpoints.
Public pages now have sitemap and robots rules, social preview cards, structured data, and canonical URLs on apivault.tech.
All sign-in methods now return you to the page you asked for, with open-redirect protection, and mobile sessions show the right device.
CLI prompts and option descriptions now consistently say "vault key", and apivault --version reads from package.json.
The MCP server moved into its own repository with no database credentials, backed by scope-enforced API endpoints on ApiVault.
MCP tokens are now isolated from general REST APIs, with stricter client registration, constant-time PKCE checks, and RFC-compliant caching and CORS.
A new public roadmap has board and list views, filters, search, and shareable links to each item.
A terminal drawer in the docs and dashboard runs CLI commands in a demo sandbox or against your real vault.
Changelog releases now have shareable pages, search, product filters, and shortcuts for asking AI assistants about a release.
This patch release fixes the license badge in the README. No commands changed.
The documentation now has a command-palette search, an install selector, a mobile navigation drawer, and step-by-step walkthroughs.
The first release of the apivault CLI injects secrets into processes without writing .env files, and manages keys and local config.
A remote MCP server lets AI coding agents such as Cursor and Claude Desktop work with your keys, using OAuth 2.1 and scopes you approve.
ApiVault launches as an encrypted vault for API keys, with environments for development, staging, and production.
Recent updates, release notes, and version history across ApiVault products.
The CLI's source now lives at github.com/ApiVault-tech/apivault.
apivault logs --source help now includes service and integration.
apivault run and env export now follow a service token's environment pin, and no command hangs on a prompt when there is no terminal.
The CLI now authenticates from APIVAULT_TOKEN, so apivault run works in a pipeline with no browser and no stored device token.
The new apivault logs command lists, filters, inspects, and streams a project's audit and request logs.
The CLI now knows when a device's token expires, warns you before it does, and explains rejected requests instead of printing a bare "Unauthorized".
Project bindings and CLI settings can now live in your project directory, so you no longer switch projects when you change directories.
apivault keys get --reveal no longer fetches the key twice.
apivault keys get, update, and delete no longer download your full key list.
A new apivault projects command group and a global --project flag let the CLI target any of your projects.
The CLI's default API URL and standalone install scripts now use the production domain.
CLI prompts and option descriptions now consistently say "vault key", and apivault --version reads from package.json.
This patch release fixes the license badge in the README. No commands changed.
The first release of the apivault CLI injects secrets into processes without writing .env files, and manages keys and local config.