Home / Manage API keys across multiple projects
Feature
Manage API keys across multiple projects
StackHangar is a secrets manager for founders who run more than one product. Every key, login, domain and subscription sits under the project it belongs to, split by prod, staging and dev, and it all stays encrypted on your device.
How keys get lost between projects
Nobody plans this. You ship one product, then a second, then a side project on a weekend. Each one adds a few more places where something important lives.
- Apple Notes. The "temporary" note with the Stripe key you pasted in 2023 and never moved.
.envfiles in five repos. The same OpenAI key in three of them, a different one in the fourth, and nobody remembers which is current.- The wrong Supabase account. You have a personal one, a company one and one from a hackathon. You rotate the key in the wrong dashboard and the app keeps failing.
- Logins in a password manager, which is good for logins and nothing else. It doesn't know a key belongs to a product, or that it expires.
With two projects you can hold this in your head. With four, you can't, and the cost shows up as a failed deploy on a Friday. What's missing is a list organised the way you think: by product.
Projects and environments
A project is one product you run. Everything that product depends on goes under it:
- API keys, logins, domains, certificates, subscriptions, memberships, databases and notes
- Each item tagged prod, staging or dev, so you can tell the production key from the test one at a glance
- A status of active, paused or retired. Paused and retired projects stay in your vault.
The Projects page lists them with how many items each has, what needs attention and the monthly cost of its subscriptions. When you create a project you choose which environments it has, so a weekend project can be prod only.
Home then shows what needs attention across all projects, most urgent first, with production ahead of other environments at the same urgency. That's how a failing key in your oldest product still gets seen while you're busy with the newest. See expiry alerts for how that list is ordered.
Which account owns each key
The hard part of several projects is rarely the key. It's knowing whose login it came from. StackHangar keeps provider accounts as their own records, so every key can say which account it belongs to.
- More than one account per provider. Add your personal Supabase and your company Supabase side by side. The Accounts page tells you when you have several at one provider, so you check you're in the right one before you rotate anything.
- One account, several projects. A single Supabase org with a database per product can serve many projects. Link the account to each of them. It shows as shared by those projects, and you don't need a separate login item in each.
- How you sign in. Record whether an account uses a password, Google, GitHub, Microsoft, Apple or company SSO. If you sign in with Google, point it at your Google account in the vault. That account then lists every account that signs in through it, which is the list you want before you change or lose a Google account.
You can also note what lives in an account (the domains, sites or databases) and your own plan limit, such as "3 domains". StackHangar doesn't know any provider's limits. The number is yours.
Bring your stack in without retyping it
You already have most of this data. The import page takes it in two forms:
- Paste a
.envfile. Each variable becomes an item you can tick, and for known providers the service is filled in for you. Pick the project and the environment, then save. - A password-manager CSV. Exports from Bitwarden, 1Password, LastPass, Chrome, Edge, Firefox and Safari work, up to 5 MB. Only logins are imported. Cards, secure notes and one-time-password seeds are skipped and counted.
Both are read in your browser. The text and the file are never uploaded, and each item is encrypted on your device before it is saved. You can add the rows to an existing project or name a new one.
Delete the export afterwards. A CSV from a password manager is every login in plain text. Once it's imported, delete the file. The import page reminds you.
Priced per project, never per key
You shouldn't think twice before adding the fiftieth key. So we don't count keys or items.
- Free: 2 projects, unlimited items, expiry alerts and 1 connected agent.
- Solo: unlimited projects, $12 a month or $99 a year.
Most people start paying when they add a third product. Full details are on the pricing section of the home page.
Common questions
Can I share one key across projects?
Not as a single item. Each item belongs to one project. If two products use the same key, you add it in each, so each project's list is complete and you can see what a rotation touches. We'd suggest one key per provider per project where the provider allows it: when a key leaks or is rotated, only that product is affected. What you can share across projects is the provider account, as described above.
What about personal and company accounts?
Add both as separate accounts, even at the same provider. Each key points at the account it came from, and the Accounts page flags providers where you have more than one. A project can use items from either.
Is this for teams?
Not yet. StackHangar today is for one founder with several products. Shared vaults for a team are planned for Studio and aren't available.
Is it a replacement for my password manager?
No. Keep using it for everyday logins. StackHangar is for what a product depends on, and for the dates and the fixes. You can import a password-manager export to get started.
What happens to a product I stop working on?
Set it to paused or retired and it stays in your vault. When you're ready to shut it down properly, the sunset playbook walks through the steps.
Put your first two projects in
Start free with two projects. Paste a .env file and you'll have the first one in a few minutes.