Workspace
A vault for your keys.
Store API keys, tokens, and passwords: encrypted, never shown to agents.
What you get
Every secret is sealed with AES-256-GCM under a secrets-namespace key. A database dump alone is inert.
Agents manage secrets by name but can never read a value: plaintext stays server-side.
Values are masked by default. Reveal is an explicit, audited, rate-limited action.
Secrets live in a workspace and are gated by membership: share a workspace, share its secrets; lose membership, lose access.
Manage them from the app, the CLI (`idapt secret …`), the SDK, or your agent: one v1 API.
Who it's for
Stash provider keys once; reference them by name from scripts and tools instead of pasting them into prompts.
Keep shared credentials in a team workspace: members get access, ex-members lose it, every reveal is logged.
Rotate a leaked key once; the old value is destroyed the moment you save the new one.
How it works
- 1Add a secret
Name it (OPENAI_API_KEY), paste the value: it's encrypted before it ever reaches the database.
- 2Use it by name
Reference the secret from the CLI, SDK, or an agent tool. The value is resolved server-side, never exposed.
- 3Reveal or rotate
Reveal the plaintext when you genuinely need it (audited), or rotate it in place to retire the old value.