Frequently Asked Questions
Everything you need to know about APIKeyConnect
APIKeyConnect uses AES-GCM encryption with PBKDF2 key derivation (100,000 iterations) to encrypt your API keys. Your master password never leaves your device and is never stored anywhere.
We offer three plans: Starter (free), Pro Developer ($9/month), and Team ($29/month). Each plan includes different features and limits.
Yes! APIKeyConnect allows you to generate ready-to-use .env files with all your API keys in one click. This feature is available on all plans.
Yes, all your encrypted data is automatically backed up to secure cloud storage. You can also export your data at any time.
For security reasons, we cannot recover your master password. However, you can reset your account, which will require re-encrypting your API keys with a new password.
Yes! Your encrypted data syncs across all your devices. Just sign in with the same account and use your master password to decrypt your keys.
You can cancel your subscription at any time from your profile settings. Your subscription will remain active until the end of the current billing period.
Yes! Our Team plan ($29/month) includes end-to-end encrypted shared vaults, team management, role-based access control, and audit logs with automatic key rotation on member revocation.
When you share a project, your browser generates a Data Encryption Key (DEK) and encrypts all API key values locally. The DEK is then individually wrapped for each team member using ECDH key exchange — so the server only ever stores ciphertext. Nobody, including us, can read your shared secrets.
When you revoke a member, a brand-new DEK is generated automatically. All keys in the shared project are re-encrypted with the new DEK and re-wrapped for the remaining members. The revoked member's wrapped copy becomes useless instantly.
We use AES-256-GCM for data encryption, PBKDF2 with 600,000 iterations for key derivation, P-256 ECDH with HKDF-SHA256 for key exchange, and AES-KW (RFC 3394) for key wrapping. All cryptographic operations run in your browser via the Web Crypto API — same primitives trusted by 1Password and AWS KMS.
No. Our zero-knowledge architecture means your master password never leaves your device and all encryption happens client-side. Our servers store only encrypted blobs. Even with full database access, we cannot decrypt your keys.