💡 Why Larik?

When working with modern AI coding agents (Claude Code, OpenCode, Cursor, Aider, Kilo, etc.) across multiple devices (office workstation, home desktop, laptop) on Windows and Linux, managing API keys is a constant headache:

• You log in to provider dashboards (OpenRouter, DeepSeek, OpenAI, Anthropic, Groq) repeatedly just to copy-paste keys and base URLs.
• Storing keys in plaintext Git repos triggers GitHub Secret Scanning, which automatically revokes your keys.
• Heavy password managers or SaaS secret vaults often lack fast terminal integration or require team subscriptions.

Larik solves this with a zero-knowledge, zero-infra terminal switcher: Your keys are encrypted locally on your machine using AES-256-GCM + PBKDF2 before being synced to a private GitHub Gist. GitHub only ever sees unreadable ciphertext.

✨ Features

• 🔐 Zero-Knowledge Encryption: AES-256-GCM authenticated encryption with PBKDF2 (SHA-512, 100k rounds). Your Master Password never leaves your device.
• ☁️ Zero-Infra Remote Sync: Backed by a private GitHub Gist (larik-vault.json). No database, no server to host, no recurring subscription.
• ⚡ Lightning Fast Terminal UX: Select an AI provider in under 3 seconds using fuzzy arrow-key navigation.
• 📋 Auto-Clipboard & OSC 52: Automatically copies your API key to the system clipboard on Windows, macOS, Linux, and remote SSH sessions via OSC 52.
• 🏷️ Multi-Profile per Provider: Store multiple keys under a single provider (e.g., openai (personal) and openai (work)).
• 🛠️ Shell Export & .env Injection: One click to append or update your project's local .env file, or print ready-to-run export commands.
• 📴 Offline Resilient: Local encrypted cache fallback keeps you productive even when internet connectivity drops.

🚀 Quick Start

Run with npx (No installation needed)

npx larik

Or install globally

npm install -g larik
larik

🔑 One-Time Setup

1. Create a GitHub Token (Classic)

Larik uses GitHub's Gist API to sync your encrypted vault.

1. Go to GitHub Token Settings (Classic).
2. Ensure the token type is Personal Access Token (classic) (starts with ghp_...).

   ⚠️ Note: Fine-grained tokens (github_pat_...) do not support GitHub Gists API.

3. Check the gist scope and click Generate token.

2. Launch Larik

larik

• Paste your GitHub PAT (saved securely with 0600 permissions in ~/.config/larik/config.json).
• Enter your Master Password. This passphrase encrypts and decrypts your vault locally.

🖥️ Usage

Terminal Interface

─── Larik AI Credential Switcher ───

? Select AI Provider Credential:
  > openrouter (personal)  https://openrouter.ai/api/v1 [OPENROUTER_API_KEY]
    deepseek (main)        https://api.deepseek.com/v1 [OPENAI_API_KEY]
    openai (work)          https://api.openai.com/v1 [OPENAI_API_KEY]
    + Add Provider / Profile
    ✕ Exit

When you select a credential:

1. The API Key is instantly copied to your operating system clipboard.
2. Provider metadata (Base URL Endpoint and Target Environment Variable) is displayed.
3. You can choose:
   • Done: Exit and paste directly into your agent or prompt.
   • Write to local .env: Automatically write or update .env in the current working directory.
   • Show shell export command: Print and copy export OPENAI_API_KEY="..." to clipboard.
   • Delete this profile: Remove old or compromised keys with a confirmation prompt.

⚙️ CLI Flags

| Flag | Description | | :--- | :--- | | larik | Run normal interactive switcher | | larik --reset | Reset and re-enter your GitHub Personal Access Token | | larik --config | Reconfigure remote storage settings |

🔒 Security Model

| Layer | Implementation | | :--- | :--- | | Cipher | AES-256-GCM (Authenticated Encryption with Associated Data) | | Key Derivation | PBKDF2 using SHA-512 and 100,000 iterations | | Salt & IV | Cryptographically secure random 16-byte salt and 12-byte IV generated fresh on every save | | Tamper Protection | 16-byte authentication tag verified on decryption | | Local Config | Stored with POSIX 0600 permissions (readable only by your user account) | | Remote Payload | Encrypted ciphertext only. GitHub never receives plaintext keys, completely safe from Secret Scanning auto-revocations |

🧪 Testing

Larik follows clean, dependency-free development principles. Run the zero-dependency test suite:

npm test

📄 License

Distributed under the MIT License.
Copyright (c) 2026 herliansyah.