rekey MCP server

rekey

Rotate API keys and tokens across providers from one CLI: mint the new key, push it to everything that uses it, verify it, retire the old one. Includes an MCP server.

Only touches accounts you administer — every provider acts with your own credential.

CLI — rotate a GitLab token straight into a .env file:

MCP — Claude rotating the same token through rekey mcp; the secret never reaches the model:

Install

Prebuilt binaries for macOS, Linux and Windows: Releases.

Or with Rust (stable):

cargo install rekey

OS keychain support (macOS Keychain, Windows Credential Manager, Linux Secret Service) is built in.

Quick start

Practice on a throwaway GitLab token first. Every command below is safe to copy; replace 28550311 with your own ids from step 3.

1. Make a throwaway token to rotate. In GitLab → Access tokens, create a token named kr-test (any scope).

2. Log in. Opens GitLab's token page with the name and api scope pre-filled. Click Create token, paste it back (input is hidden).

rekey login gitlab

Checking with GitLab…
✓ Logged in to GitLab as @you. Saved to your macOS Keychain.
  rekey now works from any terminal — nothing to export.

3. Find the key id.

rekey list gitlab

ID        NAME
28550267  rekey   (signed in with this key)
28550311  kr-test

4. Rotate it into a .env file. rekey shows the plan and waits for you.

rekey rotate gitlab 28550311 --dotenv /tmp/kr-test.env:KR_TEST_TOKEN

Here's what will happen:
  1. GitLab replaces "kr-test" with a new token and immediately revokes the old one. This can't be undone.
  2. The new token is saved to KR_TEST_TOKEN in /tmp/kr-test.env.
  3. rekey checks that the new token works.

Go ahead? [Y/n] y

Rotating kr-test…
  · Rotating (provider revokes old token immediately)…
  · Updating 1 consumer(s)…
  · Verifying new token…
  ✓ Rotated successfully.

New key id: 28550312
Updated: KR_TEST_TOKEN in /tmp/kr-test.env
Old token was revoked by the provider.

5. Check and clean up.

cat /tmp/kr-test.env      # KR_TEST_TOKEN=glpat-…
rm /tmp/kr-test.env

Then delete kr-test in GitLab.

For real keys: run rekey rotate gitlab with no arguments — it lets you pick the key and destination and can save that to rekey.toml, so the next rotation is one command. In scripts/CI:

rekey rotate gitlab 28550311 --dotenv .env --yes --no-input

Commands

Global: --config , --no-input (fail instead of prompting). --yes skips confirmation. Omitted args are prompted for in a TTY. Flags go in any order. stdout carries only list output and --print-secret values; everything else is stderr.

Destinations

rotate refuses to start unless the new secret has at least one destination.

Shortened. The full README is on GitHub.