Stop Storing API Keys in .env Files: Build an Encrypted Secret Vault in Python

GBKOMI — Tue, 16 Jun 2026 22:43:57 +0000

Stop Storing API Keys in Plain Text

If you're building Python applications, you've probably stored secrets in:

.env files
JSON files
YAML configs
Environment variables

While these approaches are common, they don't always provide strong protection for sensitive data.

I wanted a simple encrypted vault for Python projects that could securely store secrets without requiring external services.

That's why I built GBKOMI.

What is GBKOMI?

GBKOMI is a lightweight encrypted secret vault for Python applications.

Features:

Encrypted local storage
Password-protected vaults
Argon2id key derivation
Simple Python API
Command-line interface
No cloud dependency

Installation

pip install gbkomi

Create a Vault

gbkomi init secrets.vault

Store a Secret

gbkomi set secrets.vault OPENAI_API_KEY your_key_here

Retrieve a Secret

gbkomi get secrets.vault OPENAI_API_KEY

List Stored Keys

gbkomi list secrets.vault

Why I Built It

Most secret-management solutions are either:

too complex
cloud-dependent
overkill for small projects

GBKOMI aims to provide a simple middle ground:

local
encrypted
easy to automate
Security Notes

GBKOMI uses:

Argon2id for password-based key derivation
authenticated encryption
encrypted vault files

The goal is to make secret storage significantly safer than keeping credentials in plain text files.

Example Use Cases
Personal projects
AI applications
Local development
Scripts and automation tools
Small team utilities
Feedback Welcome

I'm actively improving the project and would love feedback from the Python community.

Closing Thoughts

Security is often treated as something that can be addressed later, especially in small projects. In reality, many applications start with a simple API key, a database password, or a service token sitting in a plain-text file.

GBKOMI was created to make that first step toward better security easier. It doesn't aim to replace enterprise-grade secret management platforms. Instead, it focuses on a simpler goal: providing Python developers with a lightweight, encrypted, and developer-friendly way to store sensitive information locally.

If you're working on personal projects, AI tools, automation scripts, or small-scale applications, I'd love to know whether this approach fits your workflow. Feedback, suggestions, bug reports, and contributions are all welcome as the project continues to grow.

Thanks for reading, and I hope you find GBKOMI useful in your next Python project.

GBKOMI on PyPI

DEV Community: GBKOMI

Stop Storing API Keys in .env Files: Build an Encrypted Secret Vault in Python

Closing Thoughts