Zero Plaintext at Rest • AES-256-GCM

Multi-Tenant Vault for API Keys & Agent Tokens

A private, passwordless secret manager. Every key is encrypted at rest, every tenant is completely isolated in Turso libSQL, and AI agents can query credentials programmatically via personal access tokens.

AES-256-GCM Encryption

Every field is encrypted independently with its own IV. Plaintext secrets never touch database storage, logs, or SSR HTML.

Turso libSQL Multi-Tenancy

Hard user-isolation queries. No cross-tenant reads are possible even by guessing IDs. Cryptographic UUIDs only.

AI Agent REST API

External scripts and AI agents fetch specific credentials at runtime via scoped Bearer tokens using GET /api/v1/credentials/[name].

Audit Logging on Every Reveal

Know exactly when each key was fetched or revealed, whether through the web console or via programmatic API tokens.

Structured Provider Schemas:
OpenAIAnthropicStripeTursoAWSGitHubCustom

Access Your Vault

Passwordless magic-link sign in. Automatic account creation on first verification.

No password needed. An ephemeral link expires in 15 minutes.

Rate-limited • Signed httpOnly Session Cookie