organized-keys

One source of truth for every API key, hydrated into every surface.

Kills the "I pasted it in chat and it's gone" problem permanently. An Infisical-backed secrets backbone that feeds Claude Code, MCP connectors, Cloudflare Workers, and claude.ai web connectors from a single vault.

The repo contains no secrets. Only the CLI, the registry, and empty templates. Real values live in Infisical and are streamed to a gitignored .env at use time.

Surfaces it feeds

Surface	How it consumes secrets	Command
Claude Code (local)	.env hydrated at session start	org-keys pull <project>
MCP connectors (TwelveLabs, Stape…)	x-api-key / bearer header	org-keys mcp <server>
Cloudflare Workers	wrangler secret bindings	org-keys push-cf <project>
claude.ai web connectors	connector config field (manual)	one-time paste

Architecture

                    ┌──────────────────────────────┐
                    │      SECRETS BACKBONE         │
                    │      Infisical vault          │
                    │   naming: <service>/<scope>   │
                    └──────────────┬───────────────┘
                                   │  org-keys CLI
        ┌──────────────────┬───────┼────────────────┬─────────────────┐
        ▼                  ▼       ▼                ▼                 ▼
  ┌─────────────┐  ┌──────────────┐ ┌─────────────────┐ ┌──────────────────┐
  │ Claude Code │  │ MCP headers  │ │ CF Worker secrets│ │ claude.ai web    │
  │   .env      │  │ x-api-key:…  │ │ wrangler secret  │ │ connector field  │
  └─────────────┘  └──────────────┘ └─────────────────┘ └──────────────────┘

Quick start

node bin/org-keys status        # what's wired, what's missing

# once you've installed + logged into Infisical:
brew install infisical/get-cli/infisical
infisical login

CLI

Command	Phase	Does
status	live	Reports vault CLI, registry, resolver, surface readiness
pull <project>	P2	Hydrate .env from vault
mcp <server>	P3	Emit claude mcp add … --headers "x-api-key:<vault>"
push-cf <project>	P4	wrangler secret put per project
rotate <service>/<scope>	P5	Rotate → vault → re-push all surfaces

See ARCHITECTURE/system-design.md and PLANNING/phases.md.