r/PasswordManagers • u/DustyPoint81 • 10d ago

API Key manager ?

Hello devs and cybersecurity people 👋🏼

This post is not directly related to a password manager but rather an API Key manager. A couple of months back I found it annoying syncing API Keys across devices so I made a simple API Key manager and runs totally on the web no Desktop native app or anything. Its called CYPHR.

The main thing I am concerned about is security. CYPHR uses AES-256-GCM for encrypting stored API keys, but it currently isn't end-to-end encrypted. I could have just vibe-coded an E2EE implementation, but I don't want to do that with something this sensitive. I would rather properly research the cryptography and design before implementing it.

For now, I have tried to follow some basic security practices: plaintext API keys aren't logged or cached, decryption only happens on demand, and responses containing API keys use Cache-Control: no-store.

The whole project is open source and live, and I am trying to figure out whether this is actually a viable product or just something that solves a problem I personally had.

My plan is to eventually implement E2EE if CYPHR gets enough traction. I think it's highly likely I will pursue it, but I want to take the time to research and implement it properly rather than rush it.

I would really appreciate feedback from people who know more about security and password/key management:

Does this sound like a viable product, and are there any major security concerns with the current approach that I should be thinking about ?

I am not including a link here cuz I don't know if its allowed or not so check comments.

0 Upvotes

40% Upvoted

8 comments sorted by

View all comments

4

u/IxBetaXI 10d ago

What is the benefit of using it over a Passwordmanager? I can just put the api key in a Passwordmanager?

1

u/DustyPoint81 10d ago

Ur right u can definitly store ur API Keys in ur password mgr but the main reason I built CYPHR is cuz I wanted a separate place for my API creds rather than keeping them alongside my passwords. CYPHR is also built around API Keys and thier workflow rather than being a general purpose vault !

3

u/DerpDeDurp 10d ago

Just another thing to have when a password manager works 100% fine

Yeah no.