Workspace
A vault for your keys.
Store API keys, tokens, and passwords: encrypted, never shown to agents.
What you get
Every secret is sealed with AES-256-GCM under a secrets-namespace key. A database dump alone is inert.
Agents manage secrets by name but can never read a value: plaintext stays server-side.
Values are masked by default. Reveal is an explicit, audited, rate-limited action.
Secrets live in a workspace and are gated by membership: share a workspace, share its secrets; lose membership, lose access.
Manage them from the app, the CLI (`idapt secret …`), the SDK, or your agent: one v1 API.
How it works
- 1Add a secret
Name it (OPENAI_API_KEY), paste the value: it's encrypted before it ever reaches the database.
- 2Use it by name
Reference the secret from the CLI, SDK, or an agent tool. The value is resolved server-side, never exposed.
- 3Reveal or rotate
Reveal the plaintext when you genuinely need it (audited), or rotate it in place to retire the old value.