API Manager Lite stores API keys as plain text in:

~/Library/Application Support/app.api-manager.lite/api-vault.json

The file is created with mode 0600, so only the current macOS user can read or modify it under normal filesystem permissions.

Do not commit, share, or upload this file. The application data directory is not part of this repository.

On first launch, the app copies the vault from the API Manager 1.2.x data directory when it exists. It does not modify or delete the legacy vault.

Saved secrets are read by Rust and written directly to the system clipboard. They are not returned to the React page.