API keys and app registrations
No more IDs and keys in a note: put them in their own fields, so you copy each value with one tap.
- + API keys: several keys per item, each with a name and a short description. For example API v3 and API v4 at Kit, or the API Key and the Read Access Token at TMDB.
- + App registration: for Microsoft Entra (Azure), Google OAuth and the like. Display name, Tenant ID, Client ID, Object ID, the client secret with Secret ID, the date the secret expires and the redirect URIs.
If you enter the client secret's expiry date, the item appears under Attention in Secret expiring 30 days ahead. So you create a new secret in time, before sign-in on your website stops working.
Search works on the names, never on the keys themselves. If you change a key or secret, the old one is kept in the item's history.
SSH agent: git and ssh with keys from your vault
The SSH agent works on the Mac. On iPhone and iPad you can still store and copy SSH keys in your vault.
- Put your private key in your vault: open an item (or create one), choose + SSH key and paste the private key. It starts with -----BEGIN OPENSSH PRIVATE KEY-----.
- Go to Settings › Developer and turn on SSH agent.
- Click Copy and put the two lines at the top of ~/.ssh/config.
- Try it: ssh -T [email protected]. Sifrvault asks for Touch ID, showing the name of the key and the program, such as git.
The lines for ~/.ssh/config:
- Host *
- IdentityAgent "~/Library/Group Containers/FQ3848873M.app.sifrvault/ssh-agent.sock"
Sifrvault works with ed25519, ECDSA and RSA keys. The agent can’t use a key with its own passphrase; Settings › Developer shows which ones. Your vault is already encrypted, so such a passphrase isn’t needed.
Confirming with Touch ID
For every signature and every request, Sifrvault asks for Touch ID or your Mac password. The window shows which key or item, and which program is asking.
Running lots of git commands in a row? In Settings › Developer, set Confirm again to 1, 5 or 15 minutes. When you lock your vault, Sifrvault asks again right away. If your vault is locked, the same Touch ID unlocks it too.
sifr: passwords and tokens in Terminal
- Turn on Command line (sifr) in Settings › Developer.
- Click Install sifr in Terminal… and paste one of the lines into Terminal. Sifrvault isn’t allowed to put anything outside its own folder; this line creates a link to the program inside the app.
- sifr get github: the GitHub password.
- sifr get github --field token: another field. Also: username, email, url, note, totp, or the name of a custom field.
- sifr totp github: the current 2FA code.
- sifr list: the names in your vault.
In a script, without a trailing newline: export GITHUB_TOKEN=$(sifr get github --field token -n). If Sifrvault isn’t running, sifr starts the app.
How safe is this?
- Your private keys never leave the app. ssh only gets the signature, not the key.
- Only the sifr program inside the app, signed by us, may talk to the app. Other programs are refused.
- The SSH agent can only be reached by your user on this Mac, and asks for Touch ID for every signature.
- You can’t add keys with ssh-add: your vault is the only place they live.
- So that ssh knows which keys exist even when your vault is locked, the Mac remembers the public keys (no names, no private keys).