Every developer Mac collects loose secrets. An OpenAI key in a .env on the Desktop. A Stripe test token in a Notes page. An Apple AuthKey_XXXX.p8 in Downloads from two years ago. A password manager feels like the wrong tool for them, so they stay in plain text next to the code that uses them, and anything that can read your home folder can read them too.
Developer Vault is the place to store API keys on Mac without that risk. It is a workspace inside Room Service, built for the small secrets developers actually keep: keys, tokens, and private key files, each optionally linked to the project that uses it.
How Developer Vault stores API keys on Mac
Encrypts secrets at rest. Every secret, and the index that holds its name, tags, and project link, is encrypted with AES-256-GCM. The vault key is 32 random bytes; your password wraps it through PBKDF2-HMAC-SHA256 with 600,000 iterations. Nothing is decrypted until you unlock the vault.
Unlocks with a password or Touch ID. After the first password unlock, Room Service can keep the vault key in the macOS Keychain behind Touch ID or your Mac password. The key is bound to this device, and you can require the current fingerprint set only, so a changed Touch ID enrollment invalidates it.
Imports .env and .p8 files. Pick a .env, .env.local, or .p8 file and Room Service parses it into secrets: one per KEY=value line, comments and export prefixes handled, or one secret for a private key file. Values stay in the vault; the original file is left where it was.
Copies without leaving a trace. A copied secret goes on the clipboard marked concealed and transient, so Raycast, Paste, Maccy, and Alfred skip it. If you have not copied anything else after 45 seconds, Room Service clears the clipboard. Values are masked in the list until you reveal them.
Locks itself. Auto-lock after 1, 5, or 15 minutes, or 1 hour (5 minutes by default). It also locks when the app goes to the background and when the Mac sleeps.
Exports an encrypted backup. One .roomservicevault file holds the whole vault, still encrypted, with no readable names or paths. Restoring is a two-step review: Room Service shows what would be added or replaced, and asks for the password the backup was made with before it touches anything.
How it works
Create the vault. Choose a password of at least 12 characters. Room Service generates a recovery code once, and asks you to confirm you saved it before setup counts as complete. The recovery code is the only way back in if you forget the password.
Add secrets. Paste a value, or import a
.envor.p8file. Give each one a name, tags, and an optional project from your Projects workspace.Use them. Search the list, reveal a value, or copy it. The vault logs the activity and resets the auto-lock timer.
Let it lock. Walk away, sleep the Mac, or switch apps. Next time, Touch ID or your password opens it again.
Safety: what it will and will not do
Developer Vault is the one part of Room Service that AI agents cannot reach. The MCP server has no Vault scope, so no setting can expose it, and the Health Check snapshot that the CLI and agents read is written with the Vault section removed. The roomservice CLI has no vault command at all.
Vault files live under ~/Library/Application Support/RoomService/Vault with owner-only permissions, and Room Service’s own cleanup never proposes deleting anything inside that folder. Secret values are never written to logs, diagnostics, UserDefaults, or the Command Palette’s recents.
What it will not do: it will not sync between Macs, it will not protect you if someone has your password and your Mac, and it cannot recover a vault whose files were deleted. Keep the encrypted backup somewhere safe, and keep the recovery code off this Mac.
Room Service’s Projects workspace flags credential files such as .env, .pem, and authkey.p8 sitting in project folders, so you can see what is still loose before you decide what to move.
Free vs Pro
Developer Vault is a Pro feature. The free build can open the workspace and create a vault, but adding a secret, importing a .env or .p8 file, and restoring a backup ask for Pro.