Store, refresh, and retrieve the credentials your product depends on.

Apple Pie manages OAuth and static credentials for your users' connected accounts, refreshes them before they expire, and returns tokens through a small API. Use the web app or the REST API.

What it does

Connections

Store one credential per user and provider. OAuth, API keys, bearer tokens, basic auth, and connection strings are supported.

Refresh and retrieval

Tokens refresh automatically before expiry. Retrieval returns the current token without exposing refresh credentials.

Operations

Provider templates, scoped API keys, and audit events cover setup and troubleshooting.

How credentials are stored and retrieved

Encrypted at rest

Credentials are encrypted with AES-256-GCM before storage and decrypted only when a token is minted or refreshed.

Bring your own key

Use your own key from AWS KMS, Azure Key Vault, or Google Cloud KMS. If you delete the key, stored credentials cannot be recovered—not by you and not by us.

Token responses are not written to logs. A token is shown only when you explicitly request it.

Pricing

Planned pricing for early access. Refresh is included; usage is prepaid, with no surprise postpaid overages.

Developer

Free

10 connections
100 token retrievals per month
1 user
Evaluation use, no SLA
Inactive data purged after 30 days

Free stops at its limits rather than billing overages.

Pro

$15/month

100 connections
1,000 token retrievals per month
1 user, with extra seats available
Email support
Bring your own KMS

Overage is prepaid: $0.05 per active connection and $0.02 per 100 retrievals.

Upcoming

Self-serve billing, prepaid credits, and usage/billing endpoints.
Webhooks for connection and refresh events.
Passkeys and tenant switching in the web app.
Audit streaming and extended audit retention.
Custom domains and branding for credential collection pages.

Audit browsing, billing, and webhooks are not available yet.