JetBrains Plugin

Keeper Secrets Manager plugin for JetBrains IDEs development environment

About

JetBrains IDEs are powerful integrated development environments used by millions of developers worldwide for building applications across various programming languages and frameworks. Whether you're developing in Java, Python, JavaScript, or any other supported language, JetBrains IDEs provide comprehensive tools for coding, debugging, and deployment.

The Keeper Security plugin integrates Keeper Vault into JetBrains IDEs so developers can replace hardcoded secrets with vault references and run commands with injected credentials without exposing sensitive data. The plugin supports Classic and Nested Shared Folder vault items in the same actions — folder and record pickers, secret retrieval, record create/update/generate, and secure execution from .env files.

Features

• Secret Management: Save, retrieve, and generate secrets directly from JetBrains IDEs using the Keeper Vault
• Secure Execution: Run commands with secrets injected from the Keeper Vault through .env file processing
• HTTP Client Integration (IntelliJ IDEA Ultimate / WebStorm / GoLand): Reference vault secrets directly in .http request files using the {{$keeper("uid","field")}} dynamic variable — no plaintext values in request files
• Run Configurations: Save a Run Keeper Securely configuration (.env path, working directory, command) under Run → Edit Configurations with output streaming to the Run tool window
• Folder Management: Select and manage Keeper vault folders for organized secret storage
• Record Operations: Create new records, update existing ones, and retrieve field references
• Cross-platform support: Windows, macOS, Linux
• Nested Shared Folders: Classic and Nested Shared folders and records in the same actions; automatic routing to record-* or nsf-* Commander commands
• Searchable pickers: Folder and record lists include Classic / Nested badges on each row
• Community Edition support: Core vault actions work on IntelliJ IDEA Community Edition; HTTP Client integration requires Ultimate / WebStorm / GoLand

Prerequisites

• Keeper Commander CLI

  • Must be installed and authenticated on your system
  • Download from Keeper Commander Installation Guide
  • Authenticate using Persistent login or Biometric login
  • Keeper Security Account: Active subscription with vault access
• Nested Shared Folder operations require a recent Keeper Commander with nsf-* commands. If you see errors such as unknown nsf-record-add, upgrade Commander:

  pip install --upgrade keepercommander

  • see the Nested Shared Folder CLI reference.
• System Requirements

  • JetBrains IDE: Version 2024.3 or later (IntelliJ IDEA, PyCharm, WebStorm, PhpStorm, RubyMine, CLion, GoLand, and other JetBrains IDEs on platform build 243+)
  • Java: Version 11 or later (provided by the IDE)
  • HTTP Client (optional): .http / .rest integration requires an IDE that bundles the JetBrains HTTP Client (e.g. IntelliJ IDEA Ultimate, WebStorm, GoLand). IntelliJ IDEA Community Edition does not include it; all other Keeper actions work normally on Community Edition
  • Python: Version 3.6+ (required for Keeper Commander CLI)

Setup

Installation

Using JetBrains Marketplace

1. Open your JetBrains IDE
2. Go to File → Settings → Plugins (or IntelliJ IDEA → Preferences → Plugins on macOS)
3. Search for "Keeper Security"
4. Click "Install" and restart the IDE

Authentication

The plugin supports two authentication methods through Keeper Commander CLI:

Method 1: Biometric Authentication

# Login to Keeper
keeper shell

# Register biometric authentication
biometric register

# Follow prompts to set up biometric authentication

Method 2: Persistent Login

# Login to Keeper
keeper shell

# Register device for persistent login
this-device register

# Enable persistent login
this-device persistent-login on

# Verify configuration
this-device

Plugin Verification

1. Open any JetBrains IDE
2. Go to Tools → Keeper Vault → Check Keeper Authorization
3. Verify the authentication status shows success

Usage

All Keeper actions are available through:

1. Tools Menu: Tools → Keeper Vault → [Action]
2. Right-click Context Menu: Right-click in editor → [Action]

Available Commands

Command	Description	Use Case
Check Keeper Authorization	Verify Keeper CLI installation and authentication status	Troubleshoot connection issues and verify setup
Get Keeper Secret	Insert existing secrets from vault as references (Classic or Nested Shared)	Retrieve stored secrets without exposing actual values
Add Keeper Record	Save selected text as a secret in vault and replace with reference (Classic or Nested Shared)	Replace hardcoded secrets with vault references
Update Keeper Record	Update an existing vault record by record UID and field name; routes to Classic or Nested Shared automatically	Modify existing secrets while maintaining references
Generate Keeper Secret	Generate a secure password and store in vault (Classic or Nested Shared)	Create new secure credentials automatically
Get Keeper Folder	Select a Classic or Nested Shared folder for this project (searchable list with badges)	Choose where new records are created for Add / Generate
Run Keeper Securely	Execute a command with secrets injected from a .env file — Tools menu or saved run configuration under Run → Edit Configurations	Run applications or scripts with vault-backed environment variables
Get Keeper Secret (in .http file)	Inserts {{$keeper("uid","field")}} at cursor in JetBrains HTTP Client request files (Ultimate / WebStorm / GoLand only)	Inject vault secrets directly into HTTP requests without exposing values

Nested Shared Folders (plugin 2.0.2)

Keeper supports two vault models that appear together in the plugin:

• Classic — traditional vault folders and records (record-add, record-update, …)
• Nested Shared Folder — NSF folder and records (nsf-record-add, nsf-record-update, …)

The plugin picks the correct Commander command family from vault metadata. You do not choose Classic vs Nested manually for each operation.

Folder and record pickers

• Get Keeper Folder and Get Keeper Secret show Classic and Nested Shared items in one searchable dialog.
• Each row displays a Classic or Nested badge.
• Duplicate display names are resolved by record/folder UID internally — the row you click is the one used.

Targeting a folder for new records

1. Run Tools → Keeper Vault → Get Keeper Folder and pick a folder (Classic or Nested).
2. The selection is saved for the current project.
3. Add Keeper Record and Generate Keeper Secret create records in that folder using the matching command family.
4. Get Keeper Folder is required before Add or Generate. If no folder is saved for the project, those actions prompt you to run Get Keeper Folder first.

Commander requirement

Nested Shared Folder create/update flows need a recent Commander with nsf-* support. Upgrade with pip install --upgrade keepercommander if commands such as nsf-record-add are not recognized.

Basic Secret Management

1. Retrieving Existing Secrets

# Position cursor where you want the secret reference
database_password = |

# Use: Tools → Keeper Vault → Get Keeper Secret
# Search and select a record (Classic or Nested Shared; each row shows a badge)
# Choose the field from that record
# Result:
database_password = keeper://abc123def456/field/password

1. Adding New Secrets

// Select the secret text
const apiKey = "sk-1234567890abcdef";

// Required first: Tools → Keeper Vault → Get Keeper Folder
// (pick a Classic or Nested Shared folder for the new record)
// Use: Right-click → Add Keeper Record
// Enter title and field name
// Result:
const apiKey = keeper://new-record-uid/field/api_key;

1. Generating Secure Passwords

# Position cursor
admin_password: |

# Required first: Tools → Keeper Vault → Get Keeper Folder
# (pick a Classic or Nested Shared folder for the new record)
# Use: Tools → Keeper Vault → Generate Keeper Secret
# Enter record title and field name
# Result:
admin_password: keeper://generated-record-uid/field/password

Secure Command Execution

Environment File Setup

Create a .env file with Keeper references, for example:

DATABASE_URL=keeper://db-record-uid/field/connection_string
API_KEY=keeper://api-record-uid/field/key
SECRET_KEY=keeper://app-record-uid/field/secret
JWT_SECRET=keeper://auth-record-uid/field/jwt_key

Record UID format: Values in keeper:// references must use a valid Keeper record UID (22 URL-safe Base64 characters: A-Z, a-z, 0-9, _, -). Invalid UIDs are skipped and reported as errors at run time.

Running Commands with Injected Secrets

Option 1: Quick run (right-click action)

1. Right-click in your project → Run Keeper Securely
2. Select or confirm the .env file
3. Enter your command (e.g., python3 app.py)
4. The plugin resolves secrets from the vault, runs the command, and shows output when the run completes (interactive Tools-menu flow). For repeat runs with full Run-tool-window history, use a saved Run Keeper Securely configuration (see Option 2).

# Plugin executes your command with actual values:
python3 app.py
# Environment contains:
# DATABASE_URL=postgresql://user:pass@host:5432/db
# API_KEY=ak_live_1234567890abcdef
# SECRET_KEY=super-secret-key-value
# JWT_SECRET=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Option 2: Saved Run Configuration (recommended for repeat runs)

Available since plugin version 1.1.0.

1. Go to Run → Edit Configurations… → + → Run Keeper Securely
2. Fill in the three fields:

   • Environment file (.env) — path to your .env file containing keeper:// references
   • Working directory — leave empty to use the project root
   • Command — the command to run (e.g. python main.py, node app.js)
3. Click OK and run with the standard Run/Debug toolbar buttons
4. Output and errors stream directly into the Run tool window — supports re-running, stopping, and full output history

New configurations automatically prefill the Python interpreter (from project SDK or detected venv) and common entry scripts (main.py / app.py / run.py) when found in the project root.

Complete Workflow Example

# 1. Start with hardcoded secrets (bad practice)
import os
import requests

DB_PASSWORD = "hardcoded_password_123"
API_TOKEN = "secret_api_token_xyz"

# 2. Select and replace with vault references
# Use: Add Keeper Record for each secret
DB_PASSWORD = keeper://db-creds-uid/field/password
API_TOKEN = keeper://api-creds-uid/field/token

# 3. Create .env file for secure execution
# .env contents:
# DB_PASSWORD=keeper://db-creds-uid/field/password
# API_TOKEN=keeper://api-creds-uid/field/token

# 4. Run application securely
# Use: Run Keeper Securely with command "python3 my_app.py"

HTTP Client Integration

Available since plugin version 1.1.0.

Requirement: This feature requires an IDE that bundles the JetBrains HTTP Client plugin — IntelliJ IDEA Ultimate, WebStorm, or GoLand. IntelliJ IDEA Community Edition does not include it. The rest of the Keeper plugin works normally on Community.

Nested Shared Folder records use the same {{$keeper("RECORD_UID", "field-name")}} syntax as Classic records — the UID is the Keeper record UID regardless of vault model.

The Keeper plugin registers a $keeper dynamic variable for the JetBrains HTTP Client. Use it in any .http or .rest file to reference a vault secret without typing the actual value.

Syntax

{{$keeper("RECORD_UID", "field-name")}}

• RECORD_UID — the Keeper record UID (same as in keeper://UID/field/...)
• field-name — the field path (e.g. password, login, custom.api_key)

Example

Authenticated API call

GET https://api.example.com/v1/resource
Authorization: Bearer {{$keeper("abc123def456", "password")}}
Content-Type: application/json

Basic auth

POST https://api.example.com/v1/login
Content-Type: application/json 

{
    "username": "{{$keeper("abc123def456", "login")}}",
    "password": "{{$keeper("abc123def456", "password")}}"
}

Inserting via Get Keeper Secret

Instead of typing the UID manually:

1. Open a .http file and position the cursor where you want the reference
2. Tools → Keeper Vault → Get Keeper Secret (or right-click → Get Keeper Secret)
3. Search and select a record (Classic or Nested Shared; each row shows a badge), then choose the field
4. The plugin inserts {{$keeper("uid","field")}} automatically at the cursor

Actions Reference

Check Keeper Authorization

Verifies Keeper CLI installation and authentication status.

Usage: Tools → Keeper Vault → Check Keeper Authorization

Purpose: Troubleshoot connection issues and verify setup

Get Keeper Secret

Retrieves existing secrets from vault as references.

Usage: Position cursor, then Tools → Keeper Vault → Get Keeper Secret (or right-click → Get Keeper Secret)

Properties:

• Input: Cursor position in editor
• Output: Keeper reference inserted at cursor — format depends on the file type:

File type	Inserted format
.env, .py, .js, scripts, etc.	keeper://record-uid/field/field-name
.http / .rest (HTTP Client)	{{$keeper("record-uid","field-name")}}

• Picker: Searchable list of Classic and Nested Shared records; each row shows a Classic or Nested badge
• HTTP Client: Requires IntelliJ IDEA Ultimate, WebStorm, or GoLand

Add Keeper Record

Creates a new vault record from selected text and replaces it with a reference.

Usage: Select text, then right-click → Add Keeper Record or Tools → Keeper Vault → Add Keeper Record

Properties:

• Input: Selected text containing a secret
• Output: Selected text replaced with a keeper:// reference
• Prompts: Record title, field name
• Folder targeting: Run Get Keeper Folder first to store new records in a specific Classic or Nested Shared folder
• Required: Run Get Keeper Folder first and save a project folder. Add / Generate do not run without a saved folder.
• Routing: Classic folders use record-add; Nested Shared folders use nsf-record-add

Update Keeper Record

Updates an existing vault record with a new value from selected text.

Usage: Select the new secret value (or place the caret on the value after =), then right-click → Update Keeper Record

Properties:

• Input: Selected text with the updated secret value
• Prompts: Keeper record UID, then field name
• Validation: The plugin validates the UID and confirms the record exists before updating
• Output: Text replaced with the existing record's keeper:// reference
• Routing: Classic records use record-update; Nested Shared records use nsf-record-update

Generate Keeper Secret

Generates a secure password and stores it in the vault.

Usage: Position cursor, then Tools → Keeper Vault → Generate Keeper Secret (or right-click → Generate Keeper Secret)

Properties:

• Input: Cursor position
• Output: Generated secure password reference inserted at cursor
• Prompts: Record title, field name
• Folder targeting: Run Get Keeper Folder first to create the record in a specific Classic or Nested Shared folder
• Required: Run Get Keeper Folder first and save a project folder. Add / Generate do not run without a saved folder.
• Routing: Classic folders use record-add; Nested Shared folders use nsf-record-add

Get Keeper Folder

Selects a Classic or Nested Shared folder for organizing new records in the current project.

Usage: Tools → Keeper Vault → Get Keeper Folder

Properties:

• Purpose: Set the project folder used by Add Keeper Record and Generate Keeper Secret
• Picker: Searchable list of Classic and Nested Shared folders; each row shows a Classic or Nested badge
• Scope: Applies to the current project/workspace
• Persistence: Selection remembered across IDE sessions for that project
• Routing: Classic selection routes Add/Generate to record-*; Nested Shared selection routes to nsf-*

Run Keeper Securely

Executes commands with secrets injected from .env file.

Usage: Right-click in the editor → Run Keeper Securely (or Tools → Keeper Vault → Run Keeper Securely)

Properties:

• Input: .env file with Keeper references
• Process: Fetches actual secret values from vault
• Output: Interactive run (Tools menu or editor right-click) shows output in a dialog when complete; saved Run Configuration streams output to the Run tool window
• Security: Secrets are resolved in memory and injected as environment variables; no secret values are written to disk. The subprocess environment is rebuilt from validated vault values plus a minimal whitelist of parent variables (such as PATH and HOME) — inherited IDE hook variables are not passed through
• UID validation: keeper:// record UIDs in the .env file must be valid 22-character Keeper record UIDs; invalid entries are skipped with an error

Option: Saved Run Configuration (Available since plugin version 1.1.0.)

In addition to the right-click action, Run Keeper Securely is also available as a persistent run configuration type.

Usage: Run → Edit Configurations → + → Run Keeper Securely

Properties:

• Environment file: Path to the .env file with keeper:// references (relative or absolute)
• Working directory: Directory the command runs in; empty defaults to the project root
• Command: Full command string (e.g. python main.py, node server.js, ./gradlew run)
• Output: Streams to the Run tool window — supports stop, re-run, and scrollable history
• Security: Secrets are resolved in memory and injected as environment variables; no secret values are written to disk

Platforms

The following platforms are supported:

• Linux: Ubuntu 18.04+, CentOS 7+, RHEL 7+, Debian 9+, Fedora 30+
• macOS: 10.14+ (Mojave and later)
• Windows: Windows 10+, Windows Server 2016+

Requirements

JetBrains IDEs

• IntelliJ IDEA: 2024.3+
• PyCharm: 2024.3+
• WebStorm: 2024.3+
• PhpStorm: 2024.3+
• RubyMine: 2024.3+
• CLion: 2024.3+
• GoLand: 2024.3+
• DataGrip: 2024.3+
• Rider: 2024.3+

Dependencies

• Java Runtime: 11+ (provided by JetBrains IDE)
• Python: 3.6+ (for Keeper Commander CLI)
• pip: Latest version (for CLI installation)