The vault

The vault is where your credentials live. Each one is encrypted on its own before it is stored, and it stays masked until you choose to reveal it.

What you can store

Type	Typical use
API key	Keys issued by a service, such as an AI or payments API
Personal access token	Tokens tied to your own account, such as a GitHub token
Client secret	The secret half of an OAuth application
Database credential	Connection strings and database passwords
OAuth token	Access or refresh tokens issued to an app
SSH key	Private keys used for servers or deployments
Webhook secret	Secrets used to sign or verify webhooks
Other	Anything that does not fit the list above

Every credential also has a provider, an optional project, and an environment: production, staging, development, personal or other.

Revealing a secret

Lists, search results and exports never show a secret. To see one:

1. Open the credential and choose Reveal.
2. Enter your reveal PIN.

The secret is shown for a short time and then hidden again. If the PIN is entered wrongly several times in a row, revealing is locked for a while, to slow down anyone guessing.

History

Each credential keeps its own history: when it was created, changed, rotated or revealed, and from which device. Open the credential to see it.

Expiry and rotation

You can give a credential an expiry date, a rotation interval, or both.

• Before an expiry date, KeepSafe raises an alert so the key can be replaced in time. The alert becomes critical as the date gets close.
• When a rotation interval passes, KeepSafe reminds you that the key is due to be rotated.

Statuses

KeepSafe works out a credential’s status from its dates, so it is always current:

• Active: in use and in good order.
• Attention: expiring soon or overdue for rotation.
• Expired: past its expiry date.
• Disabled: switched off by you; kept for reference.

Finding a credential

Search by name, provider or project, and filter by type, environment or status. Sort any column to bring what matters to the top.