API Locker MCP server

API Locker

One vault, three types of credentials. Replace your .env file with one token.

API Locker is an encrypted credential vault for developers. Store your LLM API keys, service API keys, and OAuth credentials in one place — then inject them into any command with apilocker run -- npm start. Your raw credentials never touch disk, never live in shell history, never get committed to git.

Free to use. Try it →

What it does

# Install
npm install -g apilocker

# One-click browser confirmation — no pasted tokens
apilocker register

# Store a credential (for any of 34 provider templates, plus "custom")
apilocker store --name OPENAI_API_KEY --provider openai --key sk-proj-...

# Run any command with your vault secrets injected as env vars
apilocker run -- npm start
#  ↑
#  process.env.OPENAI_API_KEY is populated for the lifetime of this command,
#  then gone. No .env file. Nothing on disk. Nothing in shell history.

That's the whole pitch. Everything else in this repo is making that flow work for every kind of credential a developer has to deal with.

One vault, three types of credentials

API Locker distinguishes three credential types because they're used differently:

🧠 LLM API Keys

Single opaque tokens for model APIs.

OpenAI, Anthropic, Gemini, Groq, Mistral.

apilocker store --name OPENAI_API_KEY \
  --provider openai \
  --key sk-proj-xxxxx

⚡ Service API Keys

Single tokens for everyday SaaS.

Stripe, Twilio, Resend, ElevenLabs, Cloudflare, GitHub, Clerk, Sentry, PostHog, Cloudinary, Mux, SendGrid, Vercel, Upstash, LemonSqueezy.

apilocker store --name STRIPE_SECRET_KEY \
  --provider stripe \
  --key sk_live_xxxxx

🔗 OAuth Credentials

Multi-field credentials for sign-in flows.

Google, GitHub, Slack, Microsoft, Notion, Spotify, Twitter/X, LinkedIn, Discord, Zoom, Dropbox, Salesforce, HubSpot.

apilocker store --oauth \
  --name google-oauth \
  --provider google-oauth \
  --client-id ... \
  --client-secret ...

Under the hood, LLM and Service credentials share the same single-string encrypted storage. OAuth is a multi-field encrypted JSON blob. Users experience three product surfaces; implementation shares one foundation.

Why not just use .env files?

Features

Shortened. The full README is on GitHub.