Your AI tools' usage, in the menu bar. Your API keys, in the Keychain.

Keysreallysafe reads the usage files Claude Code, Codex and Grok already write on your Mac, shows plan windows and spend at a glance, and keeps every API key behind Touch ID. Nothing leaves your Mac.

Try free for 14 days See how it works

$29 once. No subscription, no account. 14-day refund, no questions. macOS 14+, Apple Silicon.

FinderFileEditViewGoWindowHelp C 14%Wed 22 Sep11:13 PM

127.0.0.1:12766 — Keysreallysafe

The Usage pane of the local dashboard: Claude weekly 12% used, Codex weekly 87% used, this month's tokens from local logs.

Usage meter

Every plan window, without opening a single dashboard.

Claude's five-hour, Fable and weekly windows. Codex's five-hour and weekly. Grok's weekly. As % used · resets in, read from the files each tool keeps on your Mac.

Tokens are what your Mac measured. Dollars appear only when you ask, priced from a published list-price table.
A provider whose quota isn't in a local file says not tracked, with a link to its own page. Never a guess.
Today by hour, this week or month by day, split by tool and model. CSV export with the raw columns.

Chart

Key vault

Keys live in the Keychain. You see names, never values.

Paste a key once. From then on it sits in the macOS Keychain under your login, and every copy, reveal, export or rotate asks for Touch ID first.

Clipboard copies wipe themselves after 20 seconds.
Values never enter the local database, a log, the page or the API.
Remove it all with one command, after Touch ID.

Keys

Scoped gateway

Give a script one task, not your key.

One Touch ID mints a grant: one key, one host, a method and path scope, an expiry. The script calls 127.0.0.1 with the grant as its API key and the gateway adds the real one.

Lock the screen, revoke, or restart, and the grant is dead.
Every routed call lands in the usage chart. Request bodies never do.
No grant, no key lookup: a bare request gets 401.

$ keys grant router --task "list models" --minutes 30 --methods GET --paths /models Touch ID: Keys wants to let “list models” use router for 30 minutes ✓ grant issued ksf_… base http://127.0.0.1:12767/router/v1 $ curl -H "Authorization: Bearer ksf_…" http://127.0.0.1:12767/router/v1/models 200 counted under router · API keys · 1 request $ keys revoke ksf_… $ curl -H "Authorization: Bearer ksf_…" http://127.0.0.1:12767/router/v1/models 403 grant_revoked

Built so there's nothing to trust us with.

These aren't policy promises; they're how the app is wired, and the source is public so you can check.

Nothing leaves your Mac

Dashboard and API bind to 127.0.0.1 only.
No account, no sign-up, no server of ours in the loop.
Optional analytics is off by default, aggregate counters only, and can't carry prompts, keys, names, paths or device IDs.

No scraping, no borrowed logins

Never opens provider websites, cookies or browser sessions.
Never reads other tools' auth files.
Claude limits come from Claude Code's own /usage, through its existing login, with no model request.

Secrets stay secret

Key values never touch the database, a log, the page or the key-list API.
Gateway request bodies never reach the usage catalog.
Every read of a secret asks for your presence. Every time.

Full detail, including exactly what the optional analytics schema may contain, is in the source repository and on the privacy page.

One price. Yours for good.

Pay once, use it on every Mac you own, keep every update in this major version.

Keysreallysafe for Mac

$29one-time

Per person. Updates within 1.x included.

14-day free trial, full app, no card needed
Usage meter, key vault, scoped gateway, chart and export
Signed and notarized by Apple Developer ID
14-day refund, no questions asked

Buy for $29 Download the trial

What you're not buying

Keysreallysafe is not an AI subscription and includes no API credits. You use your own Claude, OpenAI, xAI or other accounts and keys; the app measures and protects them.

The optional Optimizer is experimental and makes no savings promise.

Payments are handled by Stripe. We never see your card. Prices in US dollars; tax may be added at checkout where required.

Source is public. New first-party work is proprietary; earlier MIT-licensed material and third-party components keep their licenses.

Questions

Which tools does it read?

Claude Code, OpenAI Codex CLI and Grok CLI, from the session logs and usage caches they already keep in your home folder. Anything else appears under not tracked with a link to that provider's own dashboard. Chat-app message caps are not in those files, so they aren't shown.

Does it need my provider passwords?

No. It reads files your tools already wrote and never touches their login or auth files. For the vault you paste an API key once; from then on it lives in the Keychain and comes out only after Touch ID.

Is the dollar figure real?

Tokens are real: they're what your Mac measured. Dollars are an estimate from a published list-price table applied afterwards, hidden until you choose USD, and anything unpriced reads as unknown rather than $0.

How does the trial work?

Download, run, use everything for 14 days. When it ends, the app asks for a license to keep measuring; nothing in the vault is ever locked away from you. Buy when you're ready and paste the license once.

Can I get a refund?

Yes, within 14 days of purchase, for any reason. Email support from the address you used at checkout. See the terms.

What Macs does it run on?

macOS 14 Sonoma or newer on Apple Silicon. The download is a Developer ID signed and Apple-notarized disk image, so it opens without any Gatekeeper workaround. An Intel build is not currently offered.

How do I uninstall?

keys autostart --remove unloads and deletes the login item and its snapshot; keys purge removes the local catalog and every Keychain item the app created, after Touch ID. Nothing is left behind.