Dashboard & Settings
The ApiVault web app is your primary interface for managing encrypted API keys, configuring account security, and reviewing active CLI and MCP connections.
Dashboard
The dashboard is where you create, view, edit, and delete API keys. Each key has:
| Field | Description |
|---|---|
| Name | Identifier used as the environment variable name in CLI run and dotenv export |
| Service | Label grouping keys by provider (Stripe, OpenAI, Custom, etc.) |
| Environment | Logical environment (Production, Staging, Development) — used by CLI --env and MCP list_keys filters |
| Secret value | Encrypted at rest; displayed masked in the UI |
| Notes | Optional free-text notes for your reference |
Keys can be filtered and searched from the dashboard. Reveal operations in the web UI require your vault key when using custom encryption mode.
The top navigation bar provides instant access to Overview and Settings, while the user menu dropdown includes quick links to the Home page, Documentation, and Changelog, alongside theme switching and session logout.
Settings overview
All settings pages require an authenticated session. Access them from the header menu or directly via the routes below.
General
- Display name — your profile name shown in the app
- Email address — primary account email
Security & MFA
- Password — set or change your account password
- Passkeys & biometrics — register WebAuthn passkeys (Touch ID, Face ID, Windows Hello)
- Multi-factor authentication — enable TOTP 2FA with an authenticator app
New accounts may be guided through 2FA setup during onboarding.
Sessions & Devices
- Web & browser sessions — view and revoke active browser logins
- CLI connections & tokens — view and revoke CLI devices authorized via
apivault login
MCP Connections
View AI agents connected to your vault via MCP OAuth. Each connection shows the client name, granted scopes, creation date, and last used time. Revoke any connection you no longer trust.
OAuth Connections
Link or unlink your Google account for single sign-on.
Encryption Key
Configure how your secrets are encrypted. See Security → Encryption for full details on default vs custom modes.
CLI connect flow
When you connect a terminal to your vault, ApiVault uses browser-based pairing to keep credentials safe:
Initiate pairing in terminal
Run
apivault loginin your terminal.Review device in browser
The CLI automatically opens /cli/connect displaying the requesting device identifier and IP address (redirects to sign-in first if needed).
Approve connection
Click Approve to issue a CLI token saved to
~/.apivault/token.json, or Refuse to reject access.
MCP authorize flow
When connecting an AI assistant (Cursor, Claude Desktop, Windsurf) via OAuth:
Connect from AI assistant
Add the ApiVault MCP server endpoint in your AI editor or client settings.
Review requested scopes
Your browser opens /mcp/authorize to review the requesting application and select granted scopes (
keys:read,keys:write,keys:reveal).Approve and issue OAuth token
Click Approve to generate an OAuth 2.1 access token. Manage or revoke connections anytime in Settings → MCP Connections.
Deep linking & return redirects
When accessing protected settings, documentation pages, CLI pairing requests, or MCP consent dialogs while unauthenticated or after session expiration, ApiVault automatically preserves your destination via safe callbackUrl parameters.
Upon authenticating via credentials, passkeys, TOTP, or Google Sign-In, you are seamlessly redirected back to your originating page instead of defaulting to the dashboard.
Environments & services
Environments and services are free-form labels — ApiVault does not enforce a fixed set. Common patterns:
- Environments: Production, Staging, Development, Local
- Services: Stripe, OpenAI, AWS, SendGrid, Custom
Use consistent naming across keys so CLI --env and MCP list_keys filters work predictably.