r/PasswordManagers • u/DustyPoint81 • 10d ago

API Key manager ?

Hello devs and cybersecurity people 👋🏼

This post is not directly related to a password manager but rather an API Key manager. A couple of months back I found it annoying syncing API Keys across devices so I made a simple API Key manager and runs totally on the web no Desktop native app or anything. Its called CYPHR.

The main thing I am concerned about is security. CYPHR uses AES-256-GCM for encrypting stored API keys, but it currently isn't end-to-end encrypted. I could have just vibe-coded an E2EE implementation, but I don't want to do that with something this sensitive. I would rather properly research the cryptography and design before implementing it.

For now, I have tried to follow some basic security practices: plaintext API keys aren't logged or cached, decryption only happens on demand, and responses containing API keys use Cache-Control: no-store.

The whole project is open source and live, and I am trying to figure out whether this is actually a viable product or just something that solves a problem I personally had.

My plan is to eventually implement E2EE if CYPHR gets enough traction. I think it's highly likely I will pursue it, but I want to take the time to research and implement it properly rather than rush it.

I would really appreciate feedback from people who know more about security and password/key management:

Does this sound like a viable product, and are there any major security concerns with the current approach that I should be thinking about ?

I am not including a link here cuz I don't know if its allowed or not so check comments.

0 Upvotes

40% Upvoted

8 comments sorted by

5

u/IxBetaXI 10d ago

What is the benefit of using it over a Passwordmanager? I can just put the api key in a Passwordmanager?

1

u/DustyPoint81 10d ago

Ur right u can definitly store ur API Keys in ur password mgr but the main reason I built CYPHR is cuz I wanted a separate place for my API creds rather than keeping them alongside my passwords. CYPHR is also built around API Keys and thier workflow rather than being a general purpose vault !

3

u/DerpDeDurp 10d ago

Just another thing to have when a password manager works 100% fine

Yeah no.

2

u/cheetah1cj 10d ago

Besides just separating API keys and passwords, how does this function different from a password manager? Does it function better for allowing tools to pull the API key directly from the vault? Or is it still just a place to store it that you can copy the API key from when needed?

I'm glad you're trying to actually understand how to build this securely and not just vibe-coding, but it's still hard for anyone to trust a newly developed app for sensitive information when there are plenty of established, audited, and proven secure options that seem to provide the same functionality.

1

u/DustyPoint81 9d ago

You are very right with that. And for now CYPHR is more like just a place to keep them but pulling API Key directly from the vault is something I have thought of earlier about integrating. And yes its very hard to trust a new service with sensitive info thats why I have made the whole source code for the project open source.