Projects & RBAC
ApiVault organizes encrypted credentials into isolated workspace projects. Each project has its own members, role hierarchy, audit log, service tokens, and optional vault encryption key.
Clean URLs & Workspaces
ApiVault uses a clean URL hierarchy modeled after developer platforms (https://apivault.tech/[username]/[project-slug]). Each project represents an isolated workspace with its own encryption settings and team members.
- Clean URLs: Projects are directly accessible via
/[username]/[projectSlug], with sub-pages for/members,/tokens,/integrations,/encryption, and/settings. - Project Switcher: Navigate across workspaces seamlessly using the full-height sidebar project switcher dropdown, neatly integrated with the logo.
- Collapsible Sidebar: On desktop, pull the sidebar's right edge to the left (or click it) to slide the sidebar away and give the page the full width — it snaps open or closed when you let go. While it is closed, bring it back with the open-sidebar button at the left of the header, or by pulling the thin strip at the left edge of the screen. On desktop the choice is remembered in a browser cookie, so pages load with the sidebar already in that state; on mobile the same button opens the sidebar as a drawer.
- Projects You Cannot Open: Opening a project URL you are not a member of shows a No access screen with a link back to your dashboard, and the project switcher in the header (reading Select a project) so you can jump to one of your own projects. The URL is preserved, so reloading works as soon as someone invites you. The same screen appears whether the project exists or not — ApiVault deliberately does not confirm which project slugs a given account owns, since slugs often carry client or environment names. Signed-out visitors are sent to the login page first, and returned to the URL afterwards.
- Project Avatar: Every new project gets a generated avatar, shown in the project switcher and on invitations to it. Owners and admins can swap it for a new one in Project Settings by hovering over it and pressing the regenerate button; projects created before avatars existed get their first one the same way.
- Ownership Transfer: Project owners can seamlessly transfer full ownership of a project to another team member.
- Project Vault Encryption: Owners and admins turn on Use your own vault key to encrypt the project with a key the team shares and ApiVault never stores. While it's on, the page shows where the key is entered (web app, CLI, MCP) and offers Change key. Turning the key on or off, or changing it, re-encrypts every stored key. See Security → Encryption for details.
- Project Reset & Deletion: Owners can reset vault encryption (clearing all API keys without deleting members) or permanently delete the project from the Danger Zone in Project Settings.
Role-Based Access Control (RBAC)
Projects use granular roles to ensure the right level of access:
| Role | Permissions |
|---|---|
| Owner | Full access, including project deletion, resetting encryption, bulk member actions, and transferring ownership. Only one owner per project. |
| Admin | Can manage project settings, invite/remove editors and viewers, update member roles, cancel invitations, and manage API keys. |
| Editor | Can add, update, delete, and reveal API keys. Cannot manage members, invitations, or project settings. |
| Viewer | Read-only access. Can view keys (and reveal secrets if not restricted) but cannot modify them or manage project members. |
In the Team Members tab, selection checkboxes and action menus (ellipsis) adapt dynamically according to role hierarchy: owners and admins see selection checkboxes and action menus exclusively on members they have authorization to modify or remove, while editors and viewers see a clean read-only view with personal leave options.
Any member can also leave a project from Project Settings → Leave Project. Leaving removes your access to the project's API keys immediately; an owner or admin must invite you again to rejoin. Owners cannot leave until they transfer ownership to another member from the Members page.