Fidelius

Each project keeps its own keys. Your app's OPENAI_API_KEY and your side project's OPENAI_API_KEY can be two different keys with the same name. Keys you use everywhere go in the shared project, which every project reads. To move in, choose Import .env in the File menu. Fidelius lists what it will add and saves nothing until you click Import.

Fidelius has no vault or sync of its own. Every key is an item in your Keychain, and iCloud Keychain encrypts it end to end. Apple can't read it. Turn iCloud Keychain on and your other Macs get the same projects.

Choose Install accio Command in the Setup menu once. After that, accio my-app followed by any command runs it with that project's keys as environment variables. Credential files like a .p8 key or a service account JSON arrive as a path to a temporary copy, deleted when the command ends. For a tool that insists on a file, you can still export a .env with Touch ID.

Fidelius can add a short section to the instructions of Claude Code, Codex and Gemini CLI, telling them to run commands through accio instead of reading .env files. It shows you the change first. For Cursor and other agents, it copies a setup prompt you paste into their chat. When Claude Code or Codex runs a command through accio and the output shows a key, accio replaces the value with the key's name and says it did. That covers accidents like a debug print in a test run.

In the app, revealing or copying a value takes Touch ID or your Mac password. Copied values stay on this Mac and clear from the clipboard after 60 seconds.

Recently Deleted keeps every key you delete or overwrite until you empty it. Backups are off until you turn them on. Then Fidelius saves encrypted copies to iCloud Drive or a folder you pick, locked with a password only you know.