Keyholdr is a macOS app for developers juggling API keys and secrets. Press ⌃⌥⌘K anywhere and your vault appears - Touch ID required for every copy. Keys live in the macOS Keychain, the same store Safari and iCloud use. No accounts, no sync, no analytics, no network access. Unlike password managers, Keyholdr is single-purpose: organize by platform and tag, multi-select to copy. Ships with a CLI - keyholdr pick / run - to inject secrets as env vars without aenv file.
Hey Product Hunt 👋
I built Keyholdr because I was tired of digging through Notes, .env files, and random text docs every time I needed an API key while coding. It's a tiny menu bar app: one hotkey summons your vault, Touch ID unlocks each copy, and everything stays in the macOS Keychain — no cloud, no accounts, no analytics.
It also ships a CLI so you can pull secrets straight into your terminal or scripts without hardcoding them.
Would love your feedback — especially on what would make this genuinely useful in your daily workflow. Thanks for checking it out!
Report
the cli integration is what got me - being able to inject secrets straight into a script without a .env file feels like the obvious way this should have always worked
Report
Maker
@kevserauj4 Thanks, that one's my favorite part too.
The thing that bothered me about .env files is they're just secrets sitting in cleartext on disk, one accidental git add . away from being in a commit forever. keyholdr run skips that step entirely: the secret goes straight into the child process's environment and exists only for the lifetime of that one command. Never written to a file, never in your shell history, never visible in ps.
Glad it landed the way it was supposed to. Let me know if you hit any rough edges with it.
Report
Reviews
No reviews yetBe the first to leave a review for Keyholdr
the cli integration is what got me - being able to inject secrets straight into a script without a .env file feels like the obvious way this should have always worked
@kevserauj4 Thanks, that one's my favorite part too.
The thing that bothered me about .env files is they're just secrets sitting in cleartext on disk, one accidental git add . away from being in a commit forever. keyholdr run skips that step entirely: the secret goes straight into the child process's environment and exists only for the lifetime of that one command. Never written to a file, never in your shell history, never visible in ps.
Glad it landed the way it was supposed to. Let me know if you hit any rough edges with it.