https://github.com/raiderrobert/keyser
Environment variables meet macOS Keychain — a Rust port of envchain.
https://github.com/raiderrobert/keyser
Last synced: 27 days ago
JSON representation
Environment variables meet macOS Keychain — a Rust port of envchain.
- Host: GitHub
- URL: https://github.com/raiderrobert/keyser
- Owner: raiderrobert
- License: mit
- Created: 2026-06-04T20:16:40.000Z (about 2 months ago)
- Default Branch: main
- Last Pushed: 2026-06-05T02:27:16.000Z (about 2 months ago)
- Last Synced: 2026-06-05T04:07:42.863Z (about 2 months ago)
- Language: Rust
- Homepage:
- Size: 41 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# keyser
> "The greatest trick your secrets ever played was convincing the world they didn't exist."
A Rust CLI that stores environment variables in macOS Keychain and injects them into subprocesses at runtime. A modern, maintained port of [envchain](https://github.com/sorah/envchain).
## Why?
Putting secrets in `.bashrc`, `.env` files, or shell history is a security risk. `keyser` stores them in macOS Keychain (encrypted, protected by your login password or Touch ID) and injects them only when you ask.
## Install
```sh
# From source
cargo install --path .
# Or via the install script
curl -fsSL https://raw.githubusercontent.com/raiderrobert/keyser/main/install.sh | sh
```
## Usage
### Save secrets
```sh
keyser --set aws AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
# Prompts for each value interactively
```
Pipe values for scripted use:
```sh
echo "my-secret-key" | keyser --set aws AWS_SECRET_ACCESS_KEY
```
Use `--noecho` to hide input:
```sh
keyser --set --noecho aws AWS_SECRET_ACCESS_KEY
```
### Run commands with secrets
```sh
keyser aws terraform plan
keyser aws s3 ls
```
Multiple namespaces at once:
```sh
keyser aws,github gh pr create
```
### List
```sh
# List all namespaces
keyser --list
# List keys in a namespace
keyser --list aws
# Show values too
keyser --list aws -v
```
### Remove
```sh
keyser --unset aws AWS_ACCESS_KEY_ID
```
## How it works
Each secret is stored as a generic password in your macOS login Keychain:
- **Service:** `keyser-`
- **Account:** the environment variable name
- **Password:** the value
Items are visible in Keychain Access.app and protected by your login password. iCloud sync is explicitly disabled.
## Differences from envchain
- Written in Rust (envchain is C)
- Uses modern `SecItem*` APIs (envchain uses deprecated `SecKeychain*` APIs)
- Own Keychain namespace (`keyser-` prefix, not `envchain-`)
- Handles piped/multiline input correctly
- No duplicate namespaces in `--list`
## License
MIT