KeyRotate keeps your API keys and AI subscriptions safe — watches for the signs that one has leaked, and replaces it when it needs replacing. From the developers of FrontierStack and PowerWatch. Why? This developer had his AI API keys hijacked and was billed $10K in 24 hours despite having a $400 cap on his account! I don't want anyone else to suffer that. Every key lives in the macOS Keychain, behind Touch ID. Nothing is stored in a file that could leak, nothing syncs to a server, and there is no account to create. Rotate on demand. Schedule automatic rotates. Rotate often. Rotate for safety. Rotates made easy. Rotate is your friend. GUARD: AN ALARM BELL FOR LEAKED KEYS One screen for every sign that a key may be in someone else's hands, worst first, each with one action: Rotate now, Open key or Dismiss. - AI tool logs: a key pasted into Claude Code, Codex, Gemini CLI or another coding agent went to the AI provider and sits in its logs. KeyRotate reads them hourly and rings when one of yours is there. - Repositories: every branch and tag of your GitHub, Gitea, GitLab and Bitbucket repositories, plus GitHub's own secret-scanning alerts. - Web projects: a .env, backup or script your web server would hand to anyone. - Leaked email: SMTP and mail-API passwords, addresses your site exposes, and your addresses in new Have I Been Pwned breaches. - Breach advisories: Enfour's signed notices, ranked by the keys and accounts you hold. - A key the vendor suddenly refuses, a whole account that may be disabled, expiry countdowns and rate limits. Push alerts reach you even with KeyRotate closed, including one if Guard itself stops. ROTATE, PROPERLY Where vendors let you we mint replacements. KeyRotate asks for a new key, verifies it works BEFORE saving it, saves it, verifies again — and puts the old one back if anything fails. The previous key is never revoked automatically, so a rotation can't take down a cron job or a server you forgot about; KeyRotate reminds you once every file and server has confirmed the new one. UPDATE EVERYWHERE IT IS USED Tell KeyRotate which files use a key — .env, PHP config, JSON (including Claude Code's settings.json), YAML and TOML, or your own pattern — and after any rotation it updates only what you confirm. Writes are atomic, keep permissions, and leave a one-click backup. KeyRotate matches your variable by name and replaces that line; it reads nothing else. A target can also be a file on a server, over SSH, with a sync job that retries any box that was down. TOKEN MAXING A plan's usage window starts with your first message and ends a fixed time later, used or not. KeyRotate sends one tiny message to each account the moment its window ends, and staggers your accounts so a fresh window comes up at a steady interval. ROUND-ROBIN YOUR ACCOUNTS Two Claude Max seats, or a work and a personal ChatGPT plan? KeyRotate switches between them — by hand, from the menu bar, or automatically as each allowance runs out. A key pool cycles API keys under one account when the vendor rate-limits or rejects one. TAKE PAYMENTS All the major card and payment systems, with each provider's requirements shown before you start, so a rotation never takes a storefront down at the till. SEE IT ALL AT ONCE What needs attention, which accounts are in use and how full, and what it costs this month — plan seats and API spend added up per currency. WORKS WITH YOUR TOOLS Claude Code and Codex profiles per account, OpenClaw and other agent runtimes, VibeProxy, and FrontierStack, which receives every new key over a pinned, signed local connection. PRIVATE BY DESIGN No account, no telemetry. KeyRotate talks to the vendors whose keys you asked it to check, the git hosts you add, Have I Been Pwned for the addresses you list, and — only if you turn on push alerts or pair an iPhone — Enfour's relay, which never sees your keys or the services you use. Access to files is granted by you, folder by folder.
Developer Tools · iPhone, iPad · Free
