Workspace
A vault for your keys.
Store API keys, tokens, and passwords: encrypted, never shown to agents.
What you get
Every secret is sealed with AES-256-GCM under a secrets-namespace key. A database dump alone is inert.
Agents manage secrets by name but can never read a value: plaintext stays server-side.
Values are masked by default. Reveal is an explicit, audited, rate-limited action.
Secrets live in a workspace and are gated by membership: share a workspace, share its secrets; lose membership, lose access.
Manage them from the app, the CLI (`idapt secret …`), the SDK, or your agent: one v1 API.
Who it's for
Stash provider keys once; reference them by name from scripts and tools instead of pasting them into prompts.
Keep shared credentials in a team workspace: members get access, ex-members lose it, every reveal is logged.
Rotate a leaked key once; the old value is destroyed the moment you save the new one.
How it works
- 1Add a secret
Name it (OPENAI_API_KEY), paste the value: it's encrypted before it ever reaches the database.
- 2Use it by name
Reference the secret from the CLI, SDK, or an agent tool. The value is resolved server-side, never exposed.
- 3Reveal or rotate
Reveal the plaintext when you genuinely need it (audited), or rotate it in place to retire the old value.
Frequently asked
Ready to try it?
Start free with free daily usage across 200+ models. No credit card.