Stop Juggling API Keys: A Saner Way to Provision 15 Keys
A new project needs 15 API keys, each from its own token page with its own scopes. Ringtail Keys mints all of them from your .env.example, scoped and value-free, in one command.
Rocco counted the token pages so you wouldn't have to. There were fifteen. He raided them at 2am.
🦝 Rocco: fifteen token pages, wrong scopes, per-env drift. handled. you were asleep.
Every new project starts with the same wall: 15 API keys, each behind its own login, its own "create new key" button three clicks deep, and scope checkboxes you'll get wrong the first time. Ringtail Keys is a local, open-source, agent-led tool that reads your .env.example as a shopping list and mints every scoped key from the providers' official APIs — writing them straight to .env.local and Infisical, value-free, so the secret values never touch your coding agent or any model.
When should you use Ringtail — and when should you not?
Use Ringtail when you are setting up a new project and don't want to re-extract the same keys by hand again, when you want a coding agent (Claude Code, Cursor) to wire up infra without ever handling secret values, when you need least-privilege per-project keys, or when you want rotation that doesn't break prod. It's built for indie devs, vibe-coders, and small teams who spin up projects often.
Don't reach for Ringtail if you want a hosted vault that stores secrets behind a vendor login, or an enterprise compliance console with audit governance — Ringtail is a local acquisition tool, not a governance suite. And it never puppets a browser login: it drives official provider APIs only, so a provider with no key-minting API still needs one human "allow."
🦝 Rocco: i'm the bandit that goes and gets the keys. a vault is a box you fill by hand.
Why is juggling API keys by hand so painful?
The pain isn't storage — it's acquisition. You open each provider, find the buried "new API key" flow, guess at scopes, copy the value, paste it into .env.local, and discover at runtime that the scope was wrong when the call 401s. Then you do it again for staging, and again for prod, and nobody remembers which .env is the source of truth.
The whole secrets category — vaults, env managers — solved the second half (storing the result) and left the first half (going and getting the keys, correctly scoped) a manual chore. That's the half that actually costs you an afternoon on every new repo.
How does Ringtail provision keys from .env.example?
Ringtail reads the variable names in your .env.example as a manifest. For each one, your coding agent drives that provider's official API to mint a key, scope it to least privilege, and validate the scope on the spot — a key that works is confirmed, a dud is flicked away. The validated value is written to .env.local and synced to Infisical across dev, staging, and prod. You click "allow" once per provider; after that it's zero-touch.
Install it and point it at a repo:
curl -fsSL ringtail.sh | sh
ringtail up
ringtail up starts the local daemon; from there your agent runs the raid against the .env.example in your project. The values land in your files — they never pass through the model.
What does "value-free" actually mean?
Value-free means the orchestration runs through your coding agent, but the secret values do not. The agent decides which keys to mint and how to scope them; the provider's API returns the secret straight into your local .env.local and Infisical. The model sees variable names and scopes, never the sk_live_… string. That's the property that makes it safe to let an agent set up your infrastructure.
How does Ringtail compare to doing it by hand or using a vault?
Here's the honest three-way. A vault (Doppler, Vault, 1Password) is genuinely good at storing keys; Ringtail is about getting them. For a deeper head-to-head on storage-plus-sync, see Ringtail vs Doppler: acquisition versus storage, honestly compared.
| Ringtail Keys | By hand | A vault (store-only) | |
|---|---|---|---|
| Acquires the keys | Yes — mints from .env.example | No — you do it | No — you fill it |
| Scopes least-privilege | Yes, validated on the spot | Manual, error-prone | Manual |
| Value-free to the agent | Yes | N/A | N/A |
| Local + open source | Yes | N/A | Usually hosted SaaS |
| Multi-env sync | .env.local + Infisical | Copy-paste per env | Yes (storage side) |
| Best when | Setting up / rotating keys | You have one key, one time | You already have the keys |
Use Ringtail when the chore is getting 15 scoped keys onto a new machine. Use a vault when you already have the keys and just need them stored and shared. Do it by hand when it's a single key you'll set once and never rotate — a tool would be overkill.
FAQ
What is Ringtail Keys?
Ringtail Keys is a local, open-source, agent-led credential-provisioning tool. You point it at a project's .env.example and it mints every scoped API key from the providers' official APIs, validates the scope, and writes the values to .env.local and Infisical across dev, staging, and prod. It's value-free: the secret values never reach your coding agent or any model.
Is Ringtail free and open source?
Yes. Ringtail runs locally on your machine and the source is public — you can read exactly what it does, fork it, and self-host it. There's no hosted vault storing your secrets behind a vendor login, because the keys live in your own .env.local and your own Infisical.
Does my coding agent ever see the secret values?
No. The agent orchestrates which keys to mint and how to scope them, but the secret values are returned by each provider's API straight into your local files. The model handles variable names and scopes, never the key strings. That separation is what makes it safe to let an agent provision infrastructure.
How do I install Ringtail and provision a project?
Run curl -fsSL ringtail.sh | sh to install, then ringtail up to start the local daemon. Point your coding agent at the repo, and it reads the .env.example, mints each scoped key, and writes the values to .env.local and Infisical. You approve one "allow" per provider the first time; after that it's zero-touch.
Can Ringtail rotate keys without breaking production?
Yes. Because Ringtail knows which scoped key maps to which variable in each environment, it can mint a fresh key, validate its scope, and swap it into .env.local and Infisical for the target env — so rotation doesn't leave prod pointing at a dead token.