Hand AI the kingdom.
Keep the keys.
Stop pasting API keys into chats. Stop fiddling with .env files. Noxkey stores credentials in the macOS Keychain, protected by Touch ID.
Secrets don't belong in your conversation.
Every time you paste an API key into an AI chat, it enters the model's context. Every time you pass a token as a CLI argument, it lands in your shell history. Noxkey eliminates both.
Credentials deserve better than this.
Developers work with dozens of secrets across projects. The current workflow is broken.
"Here's my API key..."
Pasting secrets into AI chats, Slack messages, or terminal prompts. Once it’s in the context, you can’t take it back.
The .env shuffle
Scattered .env files across projects. Copy-pasting between them. Accidentally committing one to git.
Expired and forgotten
An API key expires. You find out when production breaks. No warnings, no tracking. Just surprises.
How NoxKey secure sharing works.
When you run noxkey share, NoxKey encrypts the secret to a temp file and returns a random reference. The raw value never appears in your terminal, logs, or AI conversation.
You request a secret
Run noxkey share proj/API_KEY from your terminal or let your AI agent call it.
Touch ID confirms you
macOS prompts for biometric authentication. The secret is read from the Keychain only after confirmation.
Encrypted temp file created
The value is AES-256 encrypted and written to /tmp. It never appears as terminal output, shell history, or in AI context.
Decryption command returned
Instead of the secret, you get a shell command. Pass it to your build script or AI agent — it decrypts inline into the process environment.
Auto-deletes in 60 seconds
The encrypted temp file self-destructs. The secret exists only in the Keychain — nowhere on disk, in logs, or in conversation.
Secure by design. Fast by habit.
Everything you need to manage credentials without friction, and without exposing them.
Touch ID protected
Every secret retrieval requires biometric authentication. No master passwords. No unlocked vaults sitting open on your desktop.
AI-agent safe sharing
The share command encrypts secrets to temporary files that auto-delete after 60 seconds. AI agents get access without ever seeing the raw value.
Quick Access
Press Cmd+Shift+K from any app. A floating panel appears near your cursor. Search, Touch ID, copied. Under 2 seconds.
Organized by project
Name credentials as org/project/KEY and they group automatically. Filter instantly. No more hunting through .env files.
Credential types
Store API keys, login pairs, recovery codes, and plain secrets. Each with a dedicated form and type badge.
Expiry tracking
Set expiry dates on credentials. Get automatic warnings before they expire. Never find out from a production outage again.
Session unlock
Unlock a project prefix once with Touch ID. Access all credentials in that group without repeated prompts during your work session.
Clipboard auto-clear
Copied secrets are automatically cleared from your clipboard after 30 seconds. No stale credentials in your paste buffer.
macOS Keychain native
No proprietary vault. No sync servers. Everything lives in the macOS Keychain, encrypted by Apple’s Secure Enclave.
Three ways to never paste a secret again.
Menu bar app
Noxkey lives in your menu bar. Click to open, search your credentials, edit metadata, add new ones. Everything organized by project with type badges and expiry warnings.
Quick Access panel
Press Cmd+Shift+K from any app. A floating panel appears near your cursor. Type to filter, click to copy with Touch ID. Done in under 2 seconds.
CLI + AI agents
Use noxkey share to encrypt a secret to a temp file. Pass the decryption command to your AI agent or build script. The file auto-deletes. The value never enters conversation context.
Full CLI included. Zero setup.
The noxkey CLI installs automatically when you open the app. Manage credentials directly from your terminal.
Fits your existing workflow.
Noxkey integrates with the tools you already use, without requiring any changes.
Terminal & shell scripts
Use in shell substitution, build scripts, and CI pipelines. Values flow to commands without appearing in logs.
Claude Code & AI agents
Encrypted share command designed for AI. Agents get access to secrets without the raw value entering their context window.
Team workflows
Consistent naming conventions across your organization. Everyone uses the same paths, so scripts just work.
Frequently asked questions.
Is NoxKey free?
Yes. NoxKey is completely free. No accounts, no subscriptions, no telemetry.
Does NoxKey send my secrets anywhere?
No. The app has zero outbound network connections — enforced by macOS App Sandbox at the kernel level. No update checks, no telemetry, no beacons. Updates arrive exclusively through the Mac App Store, and you can verify the app's isolation anytime with noxkey verify.
What happens if I uninstall NoxKey?
Your secrets stay in the macOS Keychain. You can access them through Keychain Access or reinstall NoxKey anytime. Nothing is lost.
Does it work without Touch ID?
NoxKey requires macOS 14.0 or later with Touch ID. On Macs without Touch ID, the system falls back to your device passcode.
Can AI agents see my raw secrets?
No. Agents receive encrypted temp files that auto-delete in 60 seconds. The raw value never enters the AI context. Commands like --raw and load are hard-blocked for agent callers.
How is this different from 1Password or Bitwarden?
NoxKey is built for developers and AI workflows, not browser autofill. No sync servers, no master password, no subscription. Everything stays local in the macOS Keychain.
Stop sharing secrets. Start managing them.
Launching on the Mac App Store soon — app, CLI, and Touch ID integration in one install. Register to be notified the moment it ships.
Requires macOS 14.0 or later with Touch ID.
Visit noxkey.ai for docs, AI agent setup, and more.
Latest updates
How to Keep Your API Keys Safe When Using Cursor
Cursor indexes your workspace for AI suggestions. If your .env file is in the workspace, your secrets are in the index. Here's the fix.
Read articleApril 11, 2026Claude Code Security Best Practices — Protect Your Secrets and Your Codebase
Claude Code has full file system access. Here's how to use it safely — from .env protection to hook-based DLP scanning.
Read articleApril 8, 2026Using MCP to Give AI Agents Safe Access to Secrets
The Model Context Protocol lets AI tools call external services. Here's how to use it for secrets without exposing raw values.
Read article