Core concepts

How it fits together

Your account belongs to one or more projects. A project holds encrypted keys, each labelled with an environment and a service. Members of the project have a role, and every tool reaches the vault with a credential of its own. Everything anyone does is written to the project's audit log.

Projects

A project is a shared workspace: its own keys, members, encryption mode, service tokens, integrations and audit log. Nothing crosses between projects. In the web app a project lives at /[username]/[projectSlug], and the CLI and API accept either its ID or its slug. A directory can be tied to a project with project linking. See projects & RBAC.

Keys

A key is one encrypted secret plus its name, service, environment and optional notes. The name is what apivault run and dotenv exports use as the variable name, so STRIPE_SECRET arrives in your app as STRIPE_SECRET. A name can only be used once per environment in a project, so the same name can hold a different value in Production and Staging.

Listing keys only ever returns a masked preview. Getting the real value is a separate action, called revealing, which is logged and can be restricted on its own.

Environments

An environment is a free-form label on a key, such as Production, Staging or Development — ApiVault does not enforce a fixed set. Labels must match exactly, so use the same spelling everywhere: a key in Prod won't load for --env Production. A service token can be pinned to one environment.

Services

A service is the provider a key belongs to, such as OpenAI or Stripe. It organizes the vault and sets the logo shown beside the key; it does not change how the key is stored or used. The dashboard detects it automatically, and anything else is Custom.

Roles

Each project member is an Owner, Admin, Editor or Viewer. Owners and admins manage the project and its members, editors manage keys, and viewers have read-only access. The full list of permissions is on projects & RBAC.

Encryption modes

Every value is encrypted with AES-256-GCM. A project uses one of two modes:

• Default — the server manages the encryption key, so tools need only their credential.
• Custom — you set a vault key the server keeps no recoverable copy of. Anything that encrypts or decrypts must supply it, and if it is forgotten the stored values cannot be recovered.

See encryption architecture.

Credentials

Each kind of access has its own credential, and revoking one does not affect the others:

Audit log

Each project records who did what, from where, and whether it succeeded — including refused requests. Read it in the web app or with apivault logs.