Apiki

What the company appears to be: Apiki is a self-reported tool that presents itself as an encrypted API key workspace and zero-knowledge secret broker for AI coding agents. It allows developers to store API keys securely using client-side encryption, and provides a proxy-based mechanism for AI agents to access APIs without ever seeing raw credentials.

What changed: The project description indicates this is a hackathon submission (submitted to the OpenAI 2026 hackathon), suggesting it's at an early stage of development. It was built with technologies like Next.js, React, TypeScript, and Prisma, using SQLite for local storage.

The single most important open question: Is there any evidence that Apiki has been used beyond its own developer’s environment or tested in real-world conditions? The description states the app is honest about scope and doesn’t pretend to provide provider validation, traffic analytics, billing, email alerts, or team collaboration — but it also says nothing about actual usage or adoption.

The description states that Apiki is:

• A live encrypted API key workspace with client-side encryption (AES-GCM via Web Crypto API)
• A zero-knowledge secret broker for AI coding agents
• Built using Next.js, React, TypeScript, Prisma, and SQLite
• Uses a local SQLite database to store encrypted secrets
• Provides an MCP server and HTTP proxy gateway for agent access
• Includes policy enforcement, audit logging, and workspace monitoring rules

It is described as a tool that allows users to create encrypted workspaces, manage API keys with metadata (service, owner, environment, documentation), track rotation intervals, and monitor security scoring.

Inferred: The product appears to be a developer-focused tool for managing API credentials in a secure way, especially when used by AI agents. It does not claim to be a full secrets management platform or enterprise-grade solution.

The description states that Apiki was built to address the problem of API key leakage when AI coding agents access APIs directly. The core positioning is:

• Security-first approach: Keys are encrypted client-side and never exposed to AI agents
• Developer-centric workspace: Designed for developers managing API keys manually
• Agent-friendly proxy layer: Enables AI agents to call APIs without seeing credentials

It claims to solve a specific issue: that AI agents need access to APIs but shouldn't see raw keys, which could lead to leaks in logs or context windows.

Inferred: The positioning has evolved from a simple tool for managing API keys into one that supports secure interaction between AI agents and services — though it's not clear if this was part of the original vision or a later addition.

The description states:

• Primary users: Developers who manage API keys
• Use case: Managing API keys in a secure way, especially when used by AI coding agents (e.g., Codex, Cursor)
• Targeted audience: Individuals or small teams using local development environments

It does not mention enterprise customers or large organizations.

Inferred: The ICP seems to be individual developers or small teams working with AI tools who are concerned about credential exposure. There is no indication of B2B or SaaS targeting at this stage.

The description states:

• No pricing information is provided
• No mention of revenue, monetization, or subscription models
• The app uses a local SQLite database, which implies no cloud-based service or recurring billing model currently

Inferred: There is no evidence of any business model or pricing structure. The tool appears to be self-hosted and likely free-to-use in its current form.

The description states:

• Built with Next.js, React, TypeScript, Prisma
• Uses SQLite for local storage
• Implements client-side encryption (AES-GCM via Web Crypto API)
• Includes a proxy gateway and MCP server for agent integration
• Has a policy engine, audit logging, and monitoring rules
• UI built with a shared primitive layer and a Mouve-inspired theme

Inferred: The technical stack suggests a modern, frontend-heavy application with backend logic for proxying and policy enforcement. It is not described as a cloud-hosted SaaS offering.

The description states:

• This is a hackathon submission (OpenAI 2026)
• The app is self-reported as honest about scope, avoiding fake demos or shortcuts
• No mention of users, customers, or adoption metrics
• No evidence of revenue, ARR, headcount, or funding rounds

Inferred: There is no traction or maturity signal. It is a prototype or proof-of-concept submitted to a hackathon.

The description states:

• No direct competitors are named
• The product addresses the problem of API key leakage in AI agent workflows
• It is positioned as a tool for developers managing keys manually, not as a replacement for enterprise secrets managers

Inferred: The competitive landscape is unclear. There may be niche tools or internal solutions for API key management, but no clear market positioning or competitive differentiation is stated.

The description states:

• No evidence of real-world usage or adoption
• The app does not claim to replace a production team secrets manager
• It uses a local SQLite database, which limits scalability and collaboration
• The tool is described as honest about its limitations, but this may also reflect a lack of ambition or traction

Inferred:

• Risk: Lack of real-world testing or usage makes it hard to assess viability
• Red flag: No evidence of monetization, team size, or product-market fit beyond the author’s own use case
• Risk: The tool is limited in scope and functionality, which may hinder long-term growth

1. What is the actual usage or testing that has occurred beyond the developer's own environment?
2. Are there any plans to move away from local SQLite storage or support team collaboration?
3. How does Apiki plan to scale beyond a single-user, local workspace model?
4. Is there any intention to integrate with existing secrets management platforms or enterprise tools?
5. What is the long-term vision for monetization or product evolution?