> a pass vault can still be useful for recovery codes and API keys

You might already be aware of this, but Bitwarden also has a CLI client that can be used for this purpose, at least casually.

And can run a local webserver to expose an API (though they still need to tighten up security on it)