KeyRotate for Windows: rotate API keys and update every file that uses them

The API key manager for developers, now on Windows 10 and 11. Replace a key and KeyRotate updates every .env, config file, server and secret store that used it; and rings when one of your keys turns up where it shouldn't. Keys are encrypted to your Windows account and unlocked with Windows Hello.

Windows 10 and 11 · x64 and Arm · US$1.99 or ¥200 a month

Download for Windows Buy a subscription

On a Mac? KeyRotate is on the Mac App Store

Everything the Mac app does

Rotates keys through the vendor's API where it allows (Cloudflare, Linode, Twilio, Perplexity, Fireworks, Resend and more), checking each new key before saving it, and never revokes the old one by itself.
Writes the new key into every .env, PHP, JSON, YAML and TOML file that used it, keeping line endings and leaving a backup.
Updates servers over SSH, GitHub Actions, Netlify, Vercel, Fly.io, Supabase and Cloudflare Workers secrets, and syncs both ways with 1Password, Bitwarden, Vault, Doppler, Infisical and AWS Secrets Manager.
Guard: Leak Scan of your repositories and AI tool logs, live-site exposure checks, Enfour's signed breach advisories and stolen-key usage alerts.
Accounts, profiles and pools: switch every file and CLIProxyAPI at once, and move to the next subscription or key as each one is used up.
Warnings before a key stops working: expiry, usage limits, a rejected key or an exhausted balance.

Every feature, in detail → · Supported services →

Made for Windows

Each key is encrypted on its own with Windows' data protection (DPAPI) for your Windows account, so a copied file is unreadable on another PC or account.
Revealing a key asks for Windows Hello: face, fingerprint or PIN.
Lives in the system tray, starts with Windows if you like, and updates itself.
Reads the Windows certificate stores (read-only) to warn before a certificate expires or when its issuer is compromised.

Not on Windows: pairing with FrontierStack and Pancake Stack, the iPhone and Apple Watch companion, and VibeProxy, which are Mac apps. CLIProxyAPI works on both.

Download

KeyRotate for Mac

macOS 14 or later. Sold and updated through the Mac App Store, as a monthly subscription you start in the app.

Download on the Mac App Store

KeyRotate for Windows

Windows 10 or 11 on 64-bit Intel/AMD or Arm. A monthly subscription bought here: US$1.99 or ¥200 a month, for up to three PCs.

…

Buy a subscription

If a subscription lapses, every key stays visible and copyable on either system; only rotation, file updates and switching pause. A key manager that locked you out of your own credentials would be worse than none.

Questions

Is my Mac subscription valid on Windows?

No. The Mac edition is sold by the Mac App Store and KeyRotate for Windows here; the two subscriptions are separate.

How many PCs does one subscription cover?

Three at a time. Release a PC from KeyRotate's licence screen and activate another whenever you like.

Does it work offline?

Yes. KeyRotate checks its licence every few hours when it can; a PC can stay offline for up to 30 days before rotation and file updates pause. Your keys can always be seen and copied.

What happens if I stop paying?

Every key you stored stays visible, copyable and exportable. Only rotation, file updates and switching pause until you subscribe again.