Press release · 11 November 2026

KeyRotate is now available for Mac, Windows and Linux, with companion apps for iPhone and Android

Enfour's API key manager now runs on Mac, Windows and Linux. Free companion apps for iPhone, Apple Watch and Android show its leak alarms and let people ask their computer to rotate a key from anywhere. The phone never holds a key's value.

Enfour, Inc. today released KeyRotate for Mac, Windows and Linux, together with companion apps for iPhone, Apple Watch and Android. KeyRotate keeps developers' API keys encrypted, replaces them through the vendor's API where the vendor allows it, updates every file that uses them, and watches for signs that a key has leaked. A leaked or refused key is urgent, and its owner is often away from their desk. The companion apps show what KeyRotate found, wherever its owner is, and let them ask their computer to act.

On the computer

• Rotation that updates everything. KeyRotate gets a replacement key from the vendor, checks that it works before saving it, then rewrites every .env file, config file, server and hosting or CI secret that used the old one, keeping a backup. Where a vendor has no API for new keys, KeyRotate says so and checks the key you paste before it replaces the old one.
• Guard. One alarm screen for every sign of a leak: a key found in an AI coding tool's logs, committed to a repository or served by a website, a key a vendor suddenly refuses, and Enfour's signed breach advisories, published as Leak news.
• Keys encrypted by the system: the Keychain on a Mac, DPAPI on Windows, and the desktop keyring (GNOME Keyring or KWallet) on Linux.

On the phone and the watch

• Alarms from every paired computer, worst first, each saying what happened and when.
• The breaches that concern you. Advisories ranked as exposed, likely or possible from the keys and accounts the computer knows you hold. The ranking is worked out on the computer, and nothing about which services you use is sent anywhere.
• Rotate from anywhere. After Face ID on iPhone, or fingerprint or face unlock on Android, the computer makes the replacement key, checks it and updates every file and server that uses it, exactly as if Rotate had been pressed at the desk. A notification reports the result.
• Apple Watch shows the latest alarms, and asks for a confirmation on the wrist before any rotation is requested.

The phone never holds a key's value; it sees only key names, states and alarms. Everything between the phone and the computer is end-to-end encrypted with keys only the two devices hold, and signed by the device that sent it. Enfour's relay passes the ciphertext along and cannot read it. A request expires after 15 minutes, cannot be replayed, and is acted on only if the computer can verify it. To pair, open Guard in KeyRotate, show the pairing code and scan it with the phone. There is no account to create.

Availability

• Mac (macOS 14 or later): on the Mac App Store, with a monthly subscription started in the app.
• Windows (Windows 10 or 11, Intel/AMD or Arm) and Linux (Intel/AMD or Arm, as an AppImage, .deb or .rpm): download from frontierstack.app. One subscription, US$1.99 or ¥200 a month, covers up to three computers.
• iPhone and Apple Watch (iOS 17 or later, watchOS 10 or later): free on the App Store.
• Android (Android 10 or later): free, downloaded from frontierstack.app rather than Google Play.

The phone apps make no purchases; rotation runs on the computer, under its KeyRotate subscription. If a subscription lapses, every key stays visible and copyable; only rotation, file updates and switching pause.

###

More from Frontier News

• 9 November 2026 · FrontierStack, KeyRotate

  Enfour publishes its signed breach advisories on the FrontierStack website

  Leak news, the advisories FrontierStack and KeyRotate receive when a service or server software their users rely on is breached, is now on frontierstack.app in English, Japanese and Korean.