Keystub: keep real API keys out of .env files

.env

OPENAI_API_KEY=sk-stub-7f3a…

STRIPE_KEY=sk-stub-7f3a…

$ grep -c sk-proj .env → 0

A token in every .env

A leaked .env, log or agent transcript gives away a token you can revoke. The real key never leaves Keystub.

your app ↓ sk-stub edge ↓ real key api.openai.com

$ curl $OPENAI_BASE_URL/models → 200

Swapped on the way out

The edge checks the token, adds the real key and sends the request on. Your code only changes its base URL.

Set up Keystub for this project

$ keystub init --dry-run --json

save openai, anthropic → my-app/dev

Go ahead? yes

$ keystub doctor → all checks pass

Set up by your agent

One prompt. Your coding agent installs the CLI, signs you in, shows the plan and asks before each change.

From .env to token in three commands

What your agent runs, one step at a time. Nothing changes until you say yes.

Step 1 of 3

$ keystub init --dry-run

Output shows here.

my-app/.env2 real keys

OPENAI_API_KEY=sk-proj-••••••••••••••••real key

ANTHROPIC_API_KEY=sk-ant-••••••••••••••••real key

DATABASE_URL=postgres://localhost/app

Keystub · my-app/dev

openai · personal—

anthropic · personal—

When something goes wrong

SituationKeys in .envWith Keystub

An agent reads your .envIt sees every real key, and they end up in transcripts and logs.It sees a stand-in token.

A key leaksRotate it at the provider, then update every .env, CI secret and laptop.Revoke that one token. Nothing else stops.

You rotate a keyEdit every project and redeploy.Replace it once. Every project uses it within a second.

A teammate joinsSomeone pastes keys into chat.They run keystub init. It links the team's keys.

The bill jumpsOne total per provider key.Usage and cost by project, environment and model.

An agent loopsIt runs until the provider stops it.It stops at your per-minute or daily limit.

For teams

Shared keys

Save the team's key once. Each project links it; nobody holds a copy.

Rotate and revoke

Replace a key in one place. Each environment has its own token to revoke.

Usage and cost

Requests, tokens and cost per project, environment, key and model.

Limits

Requests per minute and per day, set per project or environment.

57 services, or your own

OpenAI, Anthropic, Stripe, GitHub, Resend and more. Add any API by its host and header.

CI and sandboxes

API keys for CI. A remote proxy for boxes where nothing can be installed.

Open core

The CLI, the swap protocol, the service catalog and a local proxy are open source. Run keystub serve on your machine, or use the hosted service with your team.

vivekverma239/keystub

CLI and agent guideopen
Swap protocol and conformance casesopen
Service catalogopen
Local and remote proxyopen
Accounts, members, usage, hosted edgehosted

Keep real API keys out of .env files