Vault

monkeys keeps nothing anywhere else. There is no file of monkeys's own to back up, leak or forget, and the desktop's own tools see everything monkeys remembers.

What an item looks like

Each secret is one item carrying two attributes: service is monkeys, and account is <profile>/<KEY>, or <KEY> alone for a key with no profile, so a project's item reads foo.test/OPENROUTER_API_KEY. The label is monkeys: followed by the account. Deleting an item in the desktop's tools deletes it for monkeys.

On macOS that is a generic password in the login keychain. Search Keychain Access for monkeys, or ask for one by account:

security find-generic-password -s monkeys -a OPENROUTER_API_KEY
security find-generic-password -s monkeys -a foo.test/OPENROUTER_API_KEY

Items are created with kSecAttrAccessibleAfterFirstUnlock, so a shell that starts while the screen is locked can still read them.

On Linux the same attributes go through secret-tool:

secret-tool lookup service monkeys account foo.test/OPENROUTER_API_KEY

What the keychain asks

A keychain item remembers the program that stored it, and asks before any other program reads it, once per item. Always Allow adds that program to the item, and the keychain stays quiet for it from then on.

What counts as the same program is its signature. The release builds are signed with one Developer ID, so an upgrade is the same program and asks nothing. A build from source is signed ad-hoc, whose identity is the binary's own hash, so each rebuild asks again for every item it reads. make install signs with a Developer ID when your keychain holds one.

security is a program of its own, so the line export writes asks once too.

The boundary is the user account. Whatever runs as you can read what you can read, here as in the startup files themselves. What the vault gives is that the secret is in none of the places a tool stumbles on: not a file in the repository, not one beside it, and not a command line.

The Secret Service on Linux

The Secret Service is a desktop session service. Over SSH or in a container there is usually no session bus and no secret daemon, and monkeys fails saying so. Machines like that want a different mechanism, not this one.