Getting Started

Installation

Download the latest build for your platform, then handle the one-time platform warning. KVault is currently unsigned, which is why you'll see a security prompt on first launch.

Download

Grab the latest installer from the Releases page on GitHub.

PlatformFileNotes
macOS (Apple Silicon)KVault_<version>_aarch64.dmgM Series
macOS (Intel)KVault_<version>_x64.dmgIntel-based Macs
WindowsKVault_<version>_x64-setup.exe / .msiWindows 10/11, 64-bit
Linux (x86_64)KVault_<version>_amd64.AppImage / _amd64.debx86_64
Linux (ARM64)KVault_<version>_aarch64.AppImage / _arm64.debaarch64

macOS

Install

  1. Download the .dmg matching your CPU (Apple Silicon vs Intel).
  2. Open the disk image and drag KVault into Applications.
  3. Eject the disk image.

First launch — Gatekeeper

KVault is not yet notarized by Apple, so macOS Gatekeeper will block the first launch with a message like "KVault can't be opened because Apple cannot check it for malicious software." This is expected — the binary is built and published from a public GitHub release, but Apple's notarization service requires a paid Developer ID certificate.

To open it the first time, use one of these two methods:

Option A — Right-click → Open

  1. Open Applications in Finder.
  2. Right-click (or Control-click) KVault and choose Open.
  3. Click Open in the confirmation dialog.

You only need to do this once. After that, KVault opens normally.

Option B — Remove the quarantine attribute

If the right-click menu doesn't show an Open option, run this in Terminal:

xattr -dr com.apple.quarantine /Applications/KVault.app

Then open KVault from Launchpad or Spotlight as usual.

Why is this necessary? macOS attaches a com.apple.quarantine extended attribute to anything downloaded from a browser. Notarized apps bypass it; unnotarized apps trigger Gatekeeper. Both options above tell Gatekeeper you trust this specific app.

Windows

Install

  1. Download either KVault_<version>_x64-setup.exe (NSIS installer) or KVault_<version>_x64.msi (MSI installer). Both work — choose .msi if your organization deploys via Group Policy.
  2. Run the installer and follow the prompts.

First launch — SmartScreen

Windows SmartScreen will show "Windows protected your PC" because the binary is not signed with an Authenticode certificate.

  1. Click More info.
  2. Click Run anyway.

You only need to do this once.

Why is this necessary? Windows trusts code signed by certificates with established reputation. KVault is not yet code-signed, so SmartScreen flags the first run. The installer is built directly from the public source on GitHub Actions.

Linux

AppImage (any distro)

chmod +x KVault_<version>_amd64.AppImage
./KVault_<version>_amd64.AppImage

Optional: integrate into your application menu using AppImageLauncher.

Debian / Ubuntu

sudo apt install ./KVault_<version>_amd64.deb

Then launch KVault from your application menu, or run kvault from a terminal.

WebKit dependency

KVault is built on Tauri 2, which uses the system WebKit. It depends on libwebkit2gtk-4.1-0 (GTK3). On Debian-based systems you can install it explicitly: 

sudo apt install libwebkit2gtk-4.1-0
Ubuntu 25.10 and newer: the libwebkit2gtk-4.1-0 package was dropped from the archive. KVault will not run on these versions until the upstream Tauri GTK4 migration lands. Workarounds: use Ubuntu 24.04 LTS (in a VM or container), or wait for a future KVault release built against GTK4.

Supported distros

  • Ubuntu 22.04 LTS, 24.04 LTS
  • Debian 12+
  • Fedora 39+ (install webkit2gtk4.1)
  • Arch / Manjaro (install webkit2gtk-4.1)

Verify the install

  1. Launch KVault. You should see the welcome screen with keyboard shortcuts.
  2. Open the command palette with Cmd+K (Ctrl+K on Windows/Linux).
  3. Continue to Getting Started to connect your first Cloudflare account.
KVault welcome screen
The welcome screen on first launch.

Uninstall

  • macOS: drag KVault from /Applications to the Trash.
  • Windows: uninstall via Settings → Apps, or run the installer's Uninstall KVault shortcut.
  • Linux (deb): sudo apt remove kvault
  • Linux (AppImage): delete the AppImage file.

Local data (cached key names, accounts metadata) lives in your OS app-data directory. API tokens are stored in the OS keychain and removed when you delete the corresponding account inside KVault — uninstalling the app does not delete them.