Dashboard & Settings

Dashboard

The dashboard is where you create, view, edit, and delete API keys. Each key has:

Keys can be filtered and searched from the dashboard. When a project vault has no stored keys, quick actions allow adding a key manually or importing an existing .env file directly. You can also export all keys for a specific environment into a ready-to-use .env file format by clicking the Export .env button. Reveal operations in the web UI require your vault key when using custom encryption mode.

The top navigation bar displays live breadcrumbs showing your current workspace project and page context (such as API Keys, Logs, Team Members, Vault Encryption, or Settings sections) with responsive truncation. Within the user menu dropdown header, an interactive Notification Bell provides instant alerts for pending project invitations, security authorizations, CLI/MCP connections, and system updates with live unread badge counters, filtering, and quick-action navigation. The dropdown also provides fast access to the Home page, Documentation, and Changelog, alongside theme switching and session logout.

Audit logs & Real-Time Event Stream

The Logs page (/[username]/[projectSlug]/logs) tracks all activity within your workspace project, providing a real-time event stream and cryptographic chain-of-custody audit trail for security and SOC2 / SIEM compliance.

• Real-Time Event Stream: Monitor activity live with incremental ?since polling that streams new events seamlessly without re-rendering or jumping existing rows.
• Indexed Event Types: Categorized security events including KEY_REVEALED (secret view across Web, CLI, or MCP), KEY_ROTATED (secret value replacement), KEY_DELETED (with pre-deletion snapshots), KEY_CREATED, MCP_TOOL_INVOKED, and CLI_CONNECTED. Integrations log INTEGRATION_CONNECTED, INTEGRATION_DISCONNECTED, INTEGRATION_LINKED, INTEGRATION_UPDATED, INTEGRATION_UNLINKED, INTEGRATION_SYNC_PREVIEWED, INTEGRATION_SYNCED, and INTEGRATION_SYNC_FAILED; work ApiVault finishes on its own, such as an automatic sync or a cleanup that completes later, is attributed to Vercel integration, Supabase integration or Cloudflare integration instead of a person and filed under the integration source. details.provider names the platform (supabase or cloudflare; entries without it are Vercel's).
• Successes and Failures: Denied and failed requests are recorded alongside the successful ones — a wrong vault key, a throttled reveal, a write refused by a read-only role, or a key that does not exist. Each failed entry keeps its HTTP status and the response's error code and message under details.errorCode / details.errorMessage, and is filed under the event type that was attempted, so a denied reveal appears as a KEY_REVEALED entry with a 4xx status. Requests rejected before their project can be resolved (an unauthenticated caller, or one with no accessible project) are not logged, because entries are stored per project.
• Facet Filtering: Filter logs by timeline (presets for 1h, 2h, 5h, 24h, Today, 7d, 30d or custom date ranges), Event Type, integration (Vercel, Supabase or Cloudflare, whatever the event, including entries from before details.provider existed; ?integration=vercel on the logs API), status level (Success for 2xx/3xx, Error for 4xx/5xx), HTTP method (GET, POST, PUT, PATCH, DELETE), source (Web, CLI, MCP, Service for service-token requests, Integration for work an integration ran on its own), specific API key, actor user, service token, or endpoint path. Requests made with a service token are attributed to the token by name, and refused token requests can be isolated with the Service Token Denials event type.
• Inspection Drawer: Click any log entry to inspect deep metadata, including AI Agent identification (Cursor, Claude Code, Windsurf), MCP tool invocation details, granted OAuth scopes, client OS & IP network classification, and raw JSON payloads.
• SIEM & Compliance Exports: Export audit logs in CSV, standard JSON, or Elastic Common Schema (ECS / NDJSON) with configurable time horizons, record limits up to 50,000 logs, and an on-demand calculated SHA-256 integrity checksum for verifiable audit trails.

Collaborative projects & Clean URLs

ApiVault uses a clean URL hierarchy modeled after developer platforms (https://apivault.tech/[username]/[project-slug]). Each project represents an isolated workspace with its own encryption settings and team members.

• Clean URLs: Projects are directly accessible via /[username]/[projectSlug], with sub-pages for /members, /tokens, /integrations, /encryption, and /settings.
• Project Switcher: Navigate across workspaces seamlessly using the full-height sidebar project switcher dropdown, neatly integrated with the logo.
• Collapsible Sidebar: On desktop, pull the sidebar's right edge to the left (or click it) to slide the sidebar away and give the page the full width — it snaps open or closed when you let go. While it is closed, bring it back with the open-sidebar button at the left of the header, or by pulling the thin strip at the left edge of the screen. On desktop the choice is remembered in a browser cookie, so pages load with the sidebar already in that state; on mobile the same button opens the sidebar as a drawer.
• Projects You Cannot Open: Opening a project URL you are not a member of shows a No access screen with a link back to your dashboard, and the project switcher in the header (reading Select a project) so you can jump to one of your own projects. The URL is preserved, so reloading works as soon as someone invites you. The same screen appears whether the project exists or not — ApiVault deliberately does not confirm which project slugs a given account owns, since slugs often carry client or environment names. Signed-out visitors are sent to the login page first, and returned to the URL afterwards.
• Project Avatar: Every new project gets a generated avatar, shown in the project switcher and on invitations to it. Owners and admins can swap it for a new one in Project Settings by hovering over it and pressing the regenerate button; projects created before avatars existed get their first one the same way.
• Ownership Transfer: Project owners can seamlessly transfer full ownership of a project to another team member.
• Project Vault Encryption: Owners and admins turn on Use your own vault key to encrypt the project with a key the team shares and ApiVault never stores. While it's on, the page shows where the key is entered (web app, CLI, MCP) and offers Change key. Turning the key on or off, or changing it, re-encrypts every stored key.
• Project Reset & Deletion: Owners can reset vault encryption (clearing all API keys without deleting members) or permanently delete the project from the Danger Zone in Project Settings.

Role-Based Access Control (RBAC)

Projects use granular roles to ensure the right level of access:

In the Team Members tab, selection checkboxes and action menus (ellipsis) adapt dynamically according to role hierarchy: owners and admins see selection checkboxes and action menus exclusively on members they have authorization to modify or remove, while editors and viewers see a clean read-only view with personal leave options.

Any member can also leave a project from Project Settings → Leave Project. Leaving removes your access to the project's API keys immediately; an owner or admin must invite you again to rejoin. Owners cannot leave until they transfer ownership to another member from the Members page.

User Settings overview

All user settings pages manage your personal account profile, authentication methods, and connection sessions.

General

• Avatar — shown in the header menu and on project members pages. Accounts registered with an email and password get a generated one, and Google sign-ups keep their Google photo. hovering over it and pressing the regenerate button replaces either with a new generated avatar
• Display name — your public profile name shown in the app
• Username — your unique account namespace (e.g. apivault.tech/username) used in project URLs. Words the site uses for its own pages, such as docs, dashboard and settings, are reserved — including for usernames filled in automatically when you sign in with Google or register without choosing one
• Email address — primary account email and verification status

Security & MFA

• Password — set or change your account password
• Passkeys & biometrics — register WebAuthn passkeys (Touch ID, Face ID, Windows Hello)
• Multi-factor authentication — enable TOTP 2FA with an authenticator app

New accounts may be guided through 2FA setup during onboarding.

Sessions & Devices

• Web & browser sessions — view and revoke active browser logins
• CLI connections & tokens — view and revoke CLI devices authorized via apivault login

MCP Connections

View AI agents connected to your vault via MCP OAuth. Each connection shows the client name, granted scopes, creation date, and last used time. Revoke any connection you no longer trust.

OAuth Connections

Link or unlink your Google account for single sign-on.

Encryption Key

Configure how your secrets are encrypted. See Security → Encryption for full details on default vs custom modes.

CLI connect flow

When you connect a terminal to your vault, ApiVault uses browser-based pairing to keep credentials safe:

1. Initiate pairing in terminal

   Run apivault login in your terminal.

2. Review device in browser

   The CLI automatically opens /cli/connect displaying the requesting device identifier and IP address (redirects to sign-in first if needed).

3. Approve connection

   Click Approve to issue a CLI token saved to ~/.apivault/token.json, or Refuse to reject access.

MCP authorize flow

When connecting an AI assistant (Cursor, Claude Desktop, Windsurf) via OAuth:

1. Connect from AI assistant

   Add the ApiVault MCP server endpoint in your AI editor or client settings.

2. Review requested scopes

   Your browser opens /mcp/authorize to review the requesting application and select granted scopes (keys:read, keys:write, keys:reveal).

3. Approve and issue OAuth token

   Click Approve to generate an OAuth 2.1 access token. Manage or revoke connections anytime in Settings → MCP Connections.

Deep linking & return redirects

When accessing protected settings, documentation pages, CLI pairing requests, or MCP consent dialogs while unauthenticated or after session expiration, ApiVault automatically preserves your destination via safe callbackUrl parameters.

Upon authenticating via credentials, passkeys, TOTP, or Google Sign-In, you are seamlessly redirected back to your originating page instead of defaulting to the dashboard.

Environments & services

Environments and services are free-form labels — ApiVault does not enforce a fixed set. Common patterns:

• Environments: Production, Staging, Development, Local
• Services: Stripe, OpenAI, AWS, SendGrid, Custom

Use consistent naming across keys so CLI --env and MCP list_keys filters work predictably.

Service logos & detection

The dashboard recognizes 34 services and shows each one's brand logo on key cards, in the table, and in the service pickers — including OpenAI, Anthropic, Google, AWS, Azure, DeepSeek, Groq, Mistral, xAI, OpenRouter, Perplexity, Together AI, Hugging Face, LangChain, ElevenLabs, Pinecone, Qdrant, Stripe, Resend, Supabase, GitHub, Cloudflare, Vercel, and Twilio. Logos come from LobeHub when an icon exists, otherwise from the service's favicon. Custom services show a key icon.

When you add a key, its service is picked for you:

• From the name — whole words anywhere in it, in any casing: OPENAI_API_KEY, groqApiKey, or “Production GPT-4 key”. Aliases such as Claude (Anthropic), Gemini (Google), and LangSmith (LangChain) count too. When several services are named, the first one wins, so AZURE_OPENAI_API_KEY is Azure.
• From the secret prefix — when the name doesn't match, a known prefix does: sk-ant-, sk-proj-, sk_live_, gsk_, pcsk_, re_, xai-, sk-or-, hf_, ghp_, AIza, and more.

In the single-key form the Service field updates as you type and notes where the match came from. Choosing a service yourself turns detection off for that key, and editing an existing key never changes its service. In bulk and .env import, keys that match nothing use the default service you chose. Keys added from the CLI or MCP server keep the service they were given, or Custom.