keybayCLI + TUI · macOS · Linux desktop
Keep secrets
out of Git.
Commit your non-secret config and kb:// references. Keybay keeps the values in an OS-protected local store, then gives your app the environment it already expects. No Keybay account or hosted service. No Keybay daemon, network path, or shell hook.
0.3.2 is available: native CLI and Dart SDK. Signed releases, documented SDK APIs, and desktop builds that work with OpenSSL 3 or 4. Follow the installation guide. If a 0.2.0 vault has a passphrase or hardware key, remove them with 0.2.0 before upgrading, then add them back.
keybay CLI · macOS / Linux
.env
Non-secret manifest
API_URL=https://staging.example.com
OPENAI_API_KEY=kb://acme-example/openai-api-keyTerminal
Run your app
$ keybay run -- ./app.sh
Keybay example app started.
API_URL: https://staging.example.com
OPENAI_API_KEY: available (value not printed)run reads the .env above, resolves its kb:// references, and passes the values to your app. Your manifest stays safe to commit.
Everyday CLI
Save it once.
Find it when you need it.
Set a value, list your keys, or reveal one in your terminal. Values stay hidden while you type.
Explore the commands →Terminal
Set · list · get
$ keybay set acme-example/openai-api-key
Value for acme-example/openai-api-key (input hidden):
Stored acme-example/openai-api-key
$ keybay list
acme-example/openai-api-key
$ keybay get acme-example/openai-api-key
sk-demo-not-a-real-keyInteractive vault
Or open your vault.
Search, reveal and edit without leaving your terminal.
$ keybay open
Try it here: select a key, press Space to reveal, or add your own. Sample data only; changes disappear when you reset or reload.
Open demo ↗Dart / Flutter SDK
Use Keybay inside your app.
Open the host application's one store, then read and write values directly. Keybay derives identity and handles storage on iOS, Android 12+, macOS, and ordinary Linux desktop.
SDK quickstart →Dart
import 'package:keybay/keybay.dart';
final session = await Keybay.open();
try {
await session.set('api-token', tokenFromOAuth);
final stored = await session.get('api-token');
} finally {
await session.close();
}Protection on each platform.
Values live in an encrypted local file. The operating system protects the key that unlocks it.
| Platform | Protected by | Protection level |
|---|---|---|
| SDK · iOS | Data Protection Keychain | App-bound key |
| SDK · Android 12+ | Android Keystore | App-bound key |
| SDK · entitled macOS | Data Protection Keychain | App-bound key |
| SDK/CLI · unentitled macOS | Login Keychain | Account-level |
| SDK/CLI · Linux desktop | Secret Service | Account-level |
App-bound key — the OS restricts key access to an app or signed group.
Account-level — another program under your user account may reach the key. Add a passphrase or hardware key for extra protection.
Levels describe key access. Record encryption is the same across platforms; file isolation and hardware backing have separate limits in each guide.
Flatpak support is an SDK candidate; CLI packaging is outside this release. Windows and Snap are unsupported.
What Keybay protects—and what it doesn't.
Full security design →- Fails closed
- If the required store is unavailable, locked, invalidated, corrupt, tampered with, or unsupported, Keybay stops. It never substitutes plaintext.
- Encrypted, coordinated writes
- Each record is independently XChaCha20-Poly1305 encrypted. Writes authenticate the source and atomically replace one complete framed file.
- Only claims it can verify
- Provider and device qualification reports only measured properties. Keybay makes no Secure Enclave claim for generic Apple Keychain items.
- Protection has a boundary
- After your app reads a value—or
runadds it to a child environment—it is ordinary process data. Same-user malware, rollback, and root remain outside the threat model.
Local by design.
Keybay is for secrets that belong on one device. Every host application, including the CLI, has one local store derived from its application identity. Keybay does not sync secrets, distribute them to a team, or provision production systems.
See where Keybay fits →Built to stay auditable: exact-pinned runtime dependencies, one framed format, and platform boundaries documented in the repository.