Developer Locker APITHE DEVELOPER’S DIRECTORY
DEVELOPER LOCKER API

Help and support

INSTRUCTIONS FOR SETUP

Directory browsing is free; sign in to edit lists. For your vault: create account → verify email → add authenticator → create vault → save recovery words. Keep a backup because vault contents are stored only on your phone.

Reading progress does not confirm account or vault setup.

Instruction step 1 of 5

1. Create your account

  1. Enter your email and a password of at least 12 characters. Read and accept the Terms.
  2. Verify the emailed code on the same page. You can check your inbox and return.
Details

1. Create your account

  1. Open Account → Create account. Enter your email and a unique password of at least 12 characters. Read and accept the Terms, then create the account.
  2. Enter the six-digit code emailed to you. Check spam if needed; use Resend after the displayed wait. Email verification proves the address is yours and is normally needed only once.

2. Add Google Authenticator

  1. Tap Set up authenticator. In Google Authenticator, add the displayed setup key, or scan the QR code from another device. Keep this key private.
  2. Return to Developer Locker API, enter the current six-digit authenticator code and tap Confirm code. Routine email verification is not repeated. After signing in with your email, password and authenticator, an eligible registered passkey can sign you back in for a fixed 24 hours without entering those details again. Returning does not extend that window. When offered, follow the device confirmation; if needed, tap Continue with passkey or use your email, password and authenticator. Your vault still needs its separate unlock.

3. Create the vault on your phone

  1. Open My vault. Complete authenticator verification and Terms acceptance if prompted, then return to Create vault.
  2. Read the red warning. Enter and repeat a unique vault passphrase of at least 16 characters, then tap Create vault. Keep it safely outside the vault.
  3. Your vault is stored on your phone, not in a web vault. Encrypted backups you export can be stored elsewhere. An optional one-time send, when enabled, temporarily displays up to five selected saved API keys, tokens, passwords or notes in your signed-in computer browser.
  4. Create your 24 recovery words. Write them down in order, confirm the requested words and tap I saved my words. Keep them offline and separate from backups; they can unlock recovery.
  5. Trust this device only on a phone you control. The vault locks after a ten-minute countdown; your account signs out after a separate thirty-minute countdown. Leaving the app starts both immediately. While the app stays open, both start after sixty seconds without activity. Activity or returning resets countdowns that have not expired. An expired vault stays locked until you unlock it; your account can remain signed in until its separate countdown expires.

4. Save and use your information

  1. Choose API key or Token under Credential type. Add the credential issued by your provider; only passwords are generated in this app. For API credentials, you have two options: save the usable key value encrypted on your phone for reuse, or save an organization-only record without retaining the usable key value. Available options depend on the credential and its security restrictions.
  2. To save and use your information, add an API credential, password or note and tap Save encrypted. Wait for the success message before leaving. Organization-only credentials store descriptions, not usable key values.
  3. Use Reveal, Copy or Android autofill deliberately. Chosen per-item authenticator or biometric protection still applies. Copied or pasted values remain usable outside Developer Locker API.
  4. The directory is free. Sign in to create or edit lists; lists need no vault or subscription and are not encrypted.

5. Keep a recoverable vault backup on your device or offline storage

  1. Vault settings → Export encrypted creates a complete .devlock backup. Save it to the phone or a compatible USB drive, check the copy, then disconnect the USB. Keep a separate offline copy: a backup stored only on the same phone will not protect against losing that phone. Export again after important changes.
  2. Keep your 24 recovery words safe. To restore your downloaded backup, use those words, or—if that backup was exported with the alternate route enabled—all three together: the account password and vault passphrase used when the backup was created, plus its registered, backup-capable passkey. Without one complete recovery route, the data in the backup cannot be recovered.
  3. Sign in to the destination account and restore into an empty local vault, including a new account if the original was deleted. Choose a vault passphrase for the restored vault. This recovers vault contents, not the deleted account’s sign-in, billing or security history. The destination account service must be available; this is not offline account access.
  4. To add the alternate route, open Vault settings → Add the three-factor backup recovery option, then choose Export with both recovery routes. A compatible passkey provider must supply the required backup capability; ordinary passkey sign-in or a fingerprint prompt alone does not establish support. Old backups without that route still require their 24 recovery words. Export a fresh backup after changing passwords or passkeys: disconnected files do not update automatically.
  5. Restoring with 24 recovery words preserves those words. Restoring through the alternate route creates a new recovery-word set for the newly restored vault. Unlock the restored vault, then save and confirm those new words before using it. Ordinary locking, sign-in and app switching do not replace confirmed recovery words.
  6. Your data remains yours. Your working vault stays encrypted on your phone without cloud synchronization, reducing exposure to breaches of cloud-stored vaults. You choose where to save encrypted backups; a storage provider you select may sync an exported file under its own settings. Copies you export or send are outside the phone vault.
  7. For one-time send, your selected items are encrypted with AES-256-GCM on your phone before transfer through our service to a device you choose. On that device, sign in to the same account in a trusted browser, open ‘Receive a key,’ and select ‘Start.’ On your phone, open a saved API key, token or password, tap ‘Send to computer,’ and enter the displayed computer code. For a batch, open My vault, tap ‘Batch send to computer,’ select one to five saved API keys, tokens, passwords or notes, then tap ‘Review pairing and send.’ Compare all four pairing words and confirm the send on your phone. The receiving browser decrypts the selected items automatically; select ‘Reveal’ or ‘Copy’ for each item to use it. Do not enter your vault passphrase or recovery words on the receiving page. Pairing requests expire after two minutes. The receiver clears all displayed items after one minute, on ‘Clear,’ or when hidden or left; clipboard history and saved copies may remain. Batches are limited to 1 MiB of encoded contents, including labels and formatting. Larger batches are refused in full; notes are not truncated. If a receiving page does not support batches, refresh it and start a new request.
  8. Protect your phone, backup files, recovery information, and receiving devices. Compromise of any of these can put your data at risk, not just the original phone.
  9. Our servers do not receive your vault’s plaintext contents or the keys needed to decrypt them. We do not receive your vault passphrase or recovery words and cannot decrypt or reconstruct a lost vault for you. We can explain recovery steps, but you must keep your own compatible backup and required recovery material. Losing the phone, uninstalling, or clearing app data can permanently lose the vault without a recoverable backup. An account password reset cannot decrypt it. Account and security information, such as your email address, is processed separately.

Use dummy credentials in this test build. Never share passwords, recovery words or verification codes with support.

Get help with your account, purchases, privacy, or a problem with the app.

Ask the support assistant

Answers come from Developer Locker API's help articles on this device. What you type isn't sent anywhere. Never type API keys, passwords, recovery words or authenticator codes.

    Support diagnostics

    Preview build details before copying them for support: available app version, source revisions, backend address, feature status and a fixed failure code. Account details, questions, vault contents, request bodies and error messages are excluded.

    Unavailable details are shown as null. A web report cannot read the app installed on your phone. Feature flags and build metadata do not prove that a feature has passed testing.

    Private test build: the assistant answers common questions on your device. This page doesn't accept or track requests, and no response-time commitment has been established.

    Inquiries and complaints

    Ask the assistant above about what you were trying to do and the screen involved.

    Never send API keys, access tokens, passwords, vault passphrases, authenticator codes, or setup secrets. Support cannot decrypt your vault or bypass authentication.

    Support availability and contact status

    Subscriptions and cancellation

    Purchases are disabled in this test build. Subscriptions are billed and canceled through Google Play, following Google Play's policies.

    Subscriptions & cancellation

    Privacy and account deletion

    Deleting a stored credential does not revoke it at its provider. Export any encrypted backups you want to keep before deleting your account.

    Privacy notice

    Report a security issue

    Use a minimal description and synthetic examples. Do not access anyone else’s data or include sensitive vault contents in a report.

    Security reporting guidance · Security disclosures

    Terms of use

    Third-party software notices