Encrypted on your PC
The API key vault is part of the Windows desktop app. It's off by default: turn on API Keys under Settings → Features. It's free and needs no sign-in.
Each key is encrypted with Windows' built-in secure storage and saved on your PC. Keys are never cloud-synced and are left out of 77Fox data backups, and the encrypted copies only open on this computer, under the same Windows account. To move to a new PC, use the encrypted export.
Each entry has a name, the key and an optional note. When you edit an entry, leaving the key field empty keeps the saved key.
Categories, groups and search
Categories run down the left and your keys sit in a table on the right. You start with AI and Cloudflare categories; rename them, add or delete categories and drag them into order. Inside a category, groups can be collapsed, renamed, colored and reordered. Drag single keys or whole groups to reorder them; to move them to another category, use Move to category in the right-click menu.
Favorite the keys you reach for most and find them under Favorites in the sidebar. Global search (Ctrl+F) matches key names across every category and shows each result's category and group, so two keys with the same name are easy to tell apart.
Not sure how to organize? Start with one category per provider, then add groups per project or per environment, such as development and production.
Masked, copied with a click
Each key in the list shows only its first and last few characters, with dots in between. Click the masked text and the full key is copied to your clipboard, with Copied shown in its place. When you share or record your screen, the list shows no full keys.
To check a key, click the eye icon: the plaintext hides again after 15 seconds and is cleared as soon as you leave the page. What lands on your clipboard is the full key, exactly as if you had copied it by hand.
Export, import and new PCs
You can export the whole vault in four formats:
- .77foxkeys encrypted backup: protected by a passphrase of at least 8 characters, entered twice. Use this one to move PCs.
- JSON: plaintext; can be imported back into 77Fox.
- Markdown and TXT: plaintext, for reading and copying only; they can't be imported.
Import accepts JSON and .77foxkeys files exported from 77Fox. By default it merges: the entries you already have stay, and new ones are added. Tick Replace all local keys, then the confirmation box, and the file replaces your whole local vault instead. Categories, groups, notes, favorites and order all come across. Import and export sit under Import & export on the vault page and in the API Keys section of Settings.
Plaintext exports contain your full keys. Delete the file when you're done, don't send it to anyone, and keep it out of public cloud folders. 77Fox doesn't store your .77foxkeys passphrase, so if you forget it, the file can't be opened.
Letting AI tools use your keys
AI tools that work through 77Fox's MCP server, such as Claude Code, Codex or Cursor, can't touch the vault by default. MCP is off until you turn it on under Features; after that, a client gets access only when you tick API key vault (plaintext) for it under Settings → MCP. That option carries a red warning and asks you to confirm.
With that scope, the client can read, edit and delete every key in the vault in plaintext, with edits and deletes still subject to its permission level; the same scope also opens the Wise API Token and the prompt translation API key saved in Settings. Grant it only to local tools you fully trust, and untick it, or revoke the client, when you no longer need it. Permission levels and the audit log are covered under MCP permissions.
Where your keys go
- Storage: on your PC, encrypted with Windows secure storage. Never uploaded to 77Fox servers, never synced to Google Drive and never included in 77Fox full backups.
- When plaintext appears: when you click the eye icon (hidden again after 15 seconds), click to copy, export a plaintext format or grant an MCP client the vault scope.
- Logs: key values are never written to 77Fox logs.
- Web and phone: the web console and Android app have no vault.
General practice on the provider side: limit each key's permissions and spending in the provider's dashboard, rotate keys regularly and delete the ones you no longer use. That all happens in each provider's console; 77Fox doesn't do it for you.