KeyRing; rotate an API key, update everywhere it was used
A Mac App Store key manager for developers. Keys live in the macOS Keychain behind Touch ID. When one is replaced, KeyRing updates every .env, config file and app that used it; and never quietly revokes the old one.
One-time purchase · macOS 14+ · No account, no subscription
What it does
Rotate where the vendor allows it
Cloudflare, Linode, Twilio, Perplexity, Fireworks and Resend can issue a replacement key through their API. KeyRing asks for one, checks it works before saving it, saves it, then checks again; and restores the previous key if anything fails.
Honest about the rest
Anthropic, GitHub, Okta, Atlassian and most others have no API that creates a key; that is the vendor's decision, not a missing feature. KeyRing says so, with the reason, and links straight to the page that issues it. Paste the new key and it is verified before it replaces the old one.
Updates every file that used it
.env, wp-config.php, JSON (including Claude Code's settings.json), YAML, TOML or your own pattern. KeyRing shows you the exact lines it would change, updates only what you confirm, writes atomically, keeps the file's permissions, and leaves a backup you can restore in one click.
Reads nothing else
KeyRing matches your variable by name and replaces that line. It never parses, displays or transmits the other secrets sitting in the same file; which is the whole reason it is safe to point at a production .env.
Switch accounts in one click
Several subscriptions or organisations for the same vendor? Group keys into accounts, name a profile; "Work", "Personal", a client; and switch every file from the menu bar.
Warns before a key stops working
A key the vendor now rejects, a real expiry countdown where one is published (Anthropic, OpenAI, Mistral, Fireworks), and usage or rate limits where they are reported; as a notification, and optionally to your phone through ntfy or Gotify.
Works with the tools you already run
FrontierStack
Pair once and KeyRing hands FrontierStack every new key over a pinned, signed connection to your own Mac. The pairing is credentials-only: it can set a key and read status, and nothing else.
Claude Code & Codex
Keep one settings profile per account and copy the exact launch command. KeyRing never touches Claude Code's own login or its Keychain item.
OpenClaw and agent runtimes
Writes the environment variable each runtime actually reads, including the list form used for rotation pools.
Why the old key is never revoked
A key is rarely in one place. Revoke it the moment you rotate and you break the cron job, the staging server or the colleague's laptop you forgot about. KeyRing leaves the previous key valid, updates everything it knows about, and then reminds you to revoke; once you can see that nothing else is still using it.
Private by design
No account. No telemetry. No sync server. Secret values are macOS Keychain items; the only other file KeyRing keeps is a list of which platform each key belongs to and which files use it. Network requests go to the vendors whose keys you asked it to check, and to a notification server if you configure one; nowhere else. Access to files outside the app is granted by you, folder by folder, and remembered only as macOS's own security-scoped bookmarks.
Coming to the Mac App Store
KeyRing is in review. Join the FrontierStack mailing list and we'll tell you when it is out.