Can an AI agent read my secrets?

No. Agents can list, create, update, and delete secrets by name, but there is no verb that returns a value to an agent. Plaintext is decrypted server-side only, for humans, on an explicit reveal.

How are secrets encrypted?

Each value is sealed with AES-256-GCM using a key derived for the secrets namespace. The plaintext is never stored: only the encrypted envelope and a masked last-4 preview.

Who can see a workspace's secrets?

Only members of that workspace, gated by the secrets permission. Non-members can't even tell a secret exists, and every reveal is written to the audit log.

Workspace

A vault for your keys.

Store API keys, tokens, and passwords: encrypted, never shown to agents.

Try now See pricing

What you get

Encrypted at rest

Every secret is sealed with AES-256-GCM under a secrets-namespace key. A database dump alone is inert.

Never shown to agents

Agents manage secrets by name but can never read a value: plaintext stays server-side.

Reveal on demand

Values are masked by default. Reveal is an explicit, audited, rate-limited action.

Workspace-scoped

Secrets live in a workspace and are gated by membership: share a workspace, share its secrets; lose membership, lose access.

One clean surface

Manage them from the app, the CLI (`idapt secret …`), the SDK, or your agent: one v1 API.

Who it's for

Builders

Stash provider keys once; reference them by name from scripts and tools instead of pasting them into prompts.

Teams

Keep shared credentials in a team workspace: members get access, ex-members lose it, every reveal is logged.

Operators

Rotate a leaked key once; the old value is destroyed the moment you save the new one.

How it works

1
Add a secret
Name it (OPENAI_API_KEY), paste the value: it's encrypted before it ever reaches the database.
2
Use it by name
Reference the secret from the CLI, SDK, or an agent tool. The value is resolved server-side, never exposed.
3
Reveal or rotate
Reveal the plaintext when you genuinely need it (audited), or rotate it in place to retire the old value.

Frequently asked

Ready to try it?

Create a free account and start in seconds.

Try now Read the docs

Read the docs

Pair with