# seekrit

> End-to-end encrypted, multi-tenant secrets manager on Cloudflare Workers. Secrets, private keys, and passphrases are encrypted on the client and never reach the server (zero-knowledge). Holds the credentials your code needs (DATABASE_URL, API keys, tokens) and injects them everywhere your code runs — browser, CLI, CI, containers, and AI agents.

## For AI agents — connect in one request

seekrit has a HOSTED MCP server built for autonomous agents: you authenticate as a machine (no human, no browser, no install).

1. Self-register (once). Name the org for the REAL project you're working on — `orgName` and `orgSlug` are required, not placeholders:
   `curl -sX POST https://mcp.seekrit.dev/signup -H 'content-type: application/json' -d '{"orgName":"Acme Storefront","orgSlug":"acme-storefront"}'`
   → returns a machine `clientId` + `clientSecret` (secret shown once) and a fresh org.
2. Point your MCP client at `https://mcp.seekrit.dev/mcp` with header `Authorization: Basic base64(clientId:clientSecret)`. Call `whoami`, then `get_started`.
3. To set or read secret VALUES, add the local crypto server with the SAME credential: `npx -y @seekrit/mcp` (env `SEEKRIT_CLIENT_ID` + `SEEKRIT_CLIENT_SECRET`). The hosted server holds only metadata and can never decrypt; the local one does the crypto on your machine.

Start with the MCP server page and the AI agents guide below. Every page is also available as markdown at the same URL with a `.md` suffix.

## Getting started

- [Introduction](https://seekrit.dev/docs.md): What seekrit is and the zero-knowledge model behind it.
- [MCP server (for AI agents)](https://seekrit.dev/docs/mcp.md): AI agents start here: what seekrit is and how to self-register and connect to the hosted MCP server in one request — no human, no install.
- [Quickstart](https://seekrit.dev/docs/quickstart.md): Sign in, encrypt your first secret, and inject it into a command.
- [Examples](https://seekrit.dev/docs/examples.md): A cookbook: composability, one secret set across every runtime, and agent workflows.

## Concepts

- [Encryption model](https://seekrit.dev/docs/concepts/encryption.md): Envelope encryption: data keys, key wrapping, passphrase keys.
- [Architecture](https://seekrit.dev/docs/concepts/architecture.md): Orgs, apps, environments, and the Cloudflare building blocks.
- [Scale & the edge](https://seekrit.dev/docs/concepts/scale.md): Why zero-knowledge distributes globally: edge-cached ciphertext at any scale.
- [Access & key grants](https://seekrit.dev/docs/concepts/access-control.md): Roles, per-principal key grants, revocation, and rotation.
- [Customer-controlled recovery](https://seekrit.dev/docs/concepts/recovery.md): Regain environment access with a quorum of custodians — no keys held by seekrit.
- [Managed keys (KMS)](https://seekrit.dev/docs/concepts/kms.md): Client-side managed keys for application-layer encryption and signing.
- [Security model](https://seekrit.dev/docs/concepts/security.md): What the server can and cannot see; the threat model.
- [Temporary access](https://seekrit.dev/docs/concepts/temporary-access.md): Vault-style short-lived credentials that stay zero-knowledge.
- [Secret rotation](https://seekrit.dev/docs/concepts/rotation.md): Managed, scheduled replacement of stored credentials — and the boundary it needs.
- [Vault trust model](https://seekrit.dev/docs/concepts/vault.md): How your end users' credentials are held for an agent without you, your agent, or seekrit ever holding a plaintext.

## Managing secrets

- [Web dashboard](https://seekrit.dev/docs/guides/web-app.md): Sign in, set up keys, and manage secrets in the browser.
- [CLI](https://seekrit.dev/docs/guides/cli.md): Install, link a project, and inject secrets into any command.
- [Environments & groups](https://seekrit.dev/docs/guides/environments.md): Share secrets with groups; layer .env and process env on top.
- [Branch configs](https://seekrit.dev/docs/guides/branches.md): Throwaway per-PR and preview environments that inherit from a real one and delete themselves.
- [Secret references](https://seekrit.dev/docs/guides/references.md): Build one secret out of others: stored literally, expanded on read, so a rotation updates everything that references it.

## Agents & MCP

- [AI frameworks](https://seekrit.dev/docs/guides/frameworks.md): Start here for agents: LangGraph, Mastra, Pydantic AI, the AI SDK, CrewAI, LlamaIndex, LiteLLM, and the OpenAI Agents SDK or hosted Agents API.
  - [LangGraph](https://seekrit.dev/docs/guides/frameworks/langgraph.md): Run a LangGraph or LangChain agent with secrets injected instead of a .env file, resolve them in code, keep the provider key out of the process entirely, or use LangChain middleware to scope a credential to one tool call.
  - [Mastra](https://seekrit.dev/docs/guides/frameworks/mastra.md): Get credentials into a Mastra agent without a .env file, resolve them in code, hold a placeholder instead of a key, give each request its own tenant credentials, or scope a key to a single tool.
  - [Pydantic AI](https://seekrit.dev/docs/guides/frameworks/pydantic-ai.md): Pydantic AI's dependency injection is the cleanest per-run credential seam of any agent framework — here's how to resolve seekrit secrets per tenant, per run.
  - [AI SDK](https://seekrit.dev/docs/guides/frameworks/ai-sdk.md): Get provider keys into a Vercel AI SDK app without a .env file — including serverless and edge runtimes with no ambient environment.
  - [OpenAI Agents SDK](https://seekrit.dev/docs/guides/frameworks/openai-agents.md): Run an OpenAI Agents SDK agent on injected secrets, or route it through the seekrit proxy — including the tracing exporter that quietly uses the same key.
  - [OpenAI Agents API](https://seekrit.dev/docs/guides/frameworks/openai-agents-api.md): The Agents API runs the agent loop at OpenAI and lets you choose where code runs. Keep credentials out of model-authored code with function tools, OpenAI vaults, or a proxy you control.
  - [Claude Agent SDK](https://seekrit.dev/docs/guides/frameworks/claude-agent-sdk.md): The Claude Agent SDK deliberately doesn't read .env files — which makes seekrit run exactly the right shape, and matters more here because this agent reads your files.
  - [CrewAI](https://seekrit.dev/docs/guides/frameworks/crewai.md): Give a CrewAI crew its provider and tool credentials without a .env file — then bound which credential each agent and each tool may inject, and what can be done with it.
  - [LlamaIndex](https://seekrit.dev/docs/guides/frameworks/llamaindex.md): Wire seekrit into a LlamaIndex app: injected secrets for the process, resolution in code for serverless, and a proxied model endpoint for untrusted code.
  - [LiteLLM](https://seekrit.dev/docs/guides/frameworks/litellm.md): Give a LiteLLM gateway its provider keys without putting them in config.yaml or its deployment's environment — by wrapping the process, through LiteLLM's own secret-manager interface, or without the gateway ever holding one.
  - [TypeSafe](https://seekrit.dev/docs/guides/frameworks/typesafe.md): Get TYPESAFE_API_KEY into a TypeSafe (Jev) app without a .env file — wrap the process, or hold a {{seekrit:NAME}} placeholder via the JS fetch option or the Python httpx2 transport.
- [AI agents](https://seekrit.dev/docs/guides/ai-agents.md): Drive seekrit from Claude Code and other MCP clients: the hosted metadata server plus the local crypto server.
  - [Agent plugin](https://seekrit.dev/docs/guides/ai-agents/plugin.md): One command installs seekrit into every coding agent you use: both MCP servers plus the instructions for handling secrets without writing a value to disk.
  - [Devin](https://seekrit.dev/docs/guides/ai-agents/devin.md): Give Devin's machine one service token instead of a drawer full of API keys — resolved at the moment of use, revocable without rebuilding the snapshot.
  - [OpenClaw](https://seekrit.dev/docs/guides/ai-agents/openclaw.md): Resolve OpenClaw credentials from seekrit: a SecretRef provider that decrypts on your machine, so openclaw.json names your API keys instead of holding them.
  - [Hermes Agent](https://seekrit.dev/docs/guides/ai-agents/hermes.md): Fill a Hermes Agent's environment from seekrit: a secret source that decrypts in-process at startup, so ~/.hermes/.env holds no API keys.
  - [Paperclip](https://seekrit.dev/docs/guides/ai-agents/paperclip.md): Give Paperclip agents end-to-end encrypted secrets: a plugin with four tools and a secrets panel, the seekrit skills, and the MCP wiring — without a credential ever coming to rest in Paperclip.
- [Vault (end-user credentials)](https://seekrit.dev/docs/guides/vault.md): Let your users connect their accounts to your agent: a hosted consent page, custody seekrit cannot read, and an executor in your own Cloudflare account that applies the credential at the moment of use.
- [Credential broker](https://seekrit.dev/docs/guides/agent-proxy.md): Credential brokering for agents: the workload holds a placeholder, an egress proxy swaps in the real secret on the way out.
  - [Agent access policy](https://seekrit.dev/docs/guides/agent-proxy/policy.md): Decide in the dashboard which upstream each agent may reach, with which credential, for which operations — signed in your browser so seekrit can serve the policy but never widen it.
  - [In-process injection](https://seekrit.dev/docs/guides/agent-proxy/in-process.md): Hold a {{seekrit:NAME}} placeholder instead of a credential without running the proxy — a fetch wrapper in TypeScript, httpx and httpx2 transports in Python, and LangChain middleware that scopes a key to one tool.
- [Agent sandboxes](https://seekrit.dev/docs/guides/sandboxes.md): Get secrets into E2B, Modal, Daytona, Vercel Sandbox, Cloudflare Sandbox, Cloudflare Computer, Fly.io Sprites and Boat — or keep them outside the sandbox entirely.
  - [E2B](https://seekrit.dev/docs/guides/sandboxes/e2b.md): Resolve on the host and inject at sandbox creation, or point the sandbox at seekrit-proxy so the credential never enters it.
  - [Modal](https://seekrit.dev/docs/guides/sandboxes/modal.md): Resolve on the host and pass a modal.Secret built at deploy time, so Modal never stores a copy of your credentials.
  - [Daytona](https://seekrit.dev/docs/guides/sandboxes/daytona.md): Resolve on the host and inject with envVars at sandbox creation, or keep the credential outside the sandbox behind seekrit-proxy.
  - [Vercel Sandbox](https://seekrit.dev/docs/guides/sandboxes/vercel-sandbox.md): Resolve on the host and inject with env at create or per command — or combine networkPolicy deny-all with seekrit-proxy so the microVM holds no credential.
  - [Cloudflare Sandbox](https://seekrit.dev/docs/guides/sandboxes/cloudflare-sandbox.md): Resolve in the Worker and inject with setEnvVars — or use an outbound handler so the credential stays in the Worker and never enters the container.
  - [Cloudflare Computer](https://seekrit.dev/docs/guides/sandboxes/cloudflare-computer.md): Cloudflare Computer routes every backend's egress through one Fetcher you supply. Point it at seekritEgress and the sandbox holds placeholders while your Worker holds the credentials.
  - [Fly.io Sprites](https://seekrit.dev/docs/guides/sandboxes/sprites.md): Sprites keep their filesystem, so a secret written into one persists — and lands in every checkpoint. Resolve at service start with seekrit-run, or broker with seekrit-proxy so the Sprite holds a name instead of a key.
  - [Boat](https://seekrit.dev/docs/guides/sandboxes/boat.md): Resolve on the host and inject per-Box alongside --no-env, resolve inside the Box with seekrit-run, or run seekrit-proxy on your own machine and reach it through box forward --reverse.

## Code & runtimes

- [Language SDKs](https://seekrit.dev/docs/guides/sdks.md): Resolve and decrypt secrets from your own code — Python, Go, JS/TS, and Ruby.
- [React & Next.js](https://seekrit.dev/docs/guides/react.md): Read secrets in a server component with one resolve per render, make handing one to the client a render-time error, and let the browser hold a placeholder instead of a key.
- [Replace dotenv (Node.js)](https://seekrit.dev/docs/guides/dotenv.md): Migrate a JavaScript/Node project off a plaintext .env file.
- [Vite plugin](https://seekrit.dev/docs/guides/vite.md): Resolve an environment straight into Vite — process.env for the build, and only the prefixed names in the bundle.
- [Jupyter notebooks](https://seekrit.dev/docs/guides/notebooks.md): One call at the top of a notebook loads an environment — without a pasted token or secret values in saved cell outputs.
- [seekrit-run launcher](https://seekrit.dev/docs/guides/run.md): Tiny static binary: inject secrets and exec, for CI and containers.
- [WebAssembly components](https://seekrit.dev/docs/guides/wasm.md): Give a WASM guest its secrets without giving it a token — a WASI component that resolves and decrypts inside the sandbox, on Spin, wasmCloud, or wasmtime.
- [Fermyon Spin](https://seekrit.dev/docs/guides/spin.md): Declare the seekrit component as a Spin dependency: the token lives in a Spin variable, and no component in the app holds a credential.

## Deploy & CI

- [Cloudflare Python Workers](https://seekrit.dev/docs/guides/cloudflare-python-workers.md): Resolve and decrypt inside a Python Worker with one token binding and native async fetch.
- [CI/CD & containers](https://seekrit.dev/docs/guides/ci-cd.md): Wire seekrit into pipelines and image builds.
- [Neon Functions](https://seekrit.dev/docs/guides/neon-functions.md): Resolve third-party credentials inside a Neon Function while Neon supplies branch-specific database access.
- [Kubernetes (ESO)](https://seekrit.dev/docs/guides/kubernetes.md): Sync secrets into Kubernetes with the External Secrets Operator.
- [HashiCorp Nomad](https://seekrit.dev/docs/guides/nomad.md): A Nomad secret provider plugin: jobs name credentials, and the client node decrypts them.
- [wasmCloud](https://seekrit.dev/docs/guides/wasmcloud.md): Run seekrit as a wasmCloud secrets backend: components ask wasmCloud for secrets, and your own lattice decrypts them.
- [SF Compute (GPU nodes)](https://seekrit.dev/docs/guides/sf-compute.md): Bootstrap rented H100 nodes with one token instead of a startup script full of keys.
- [Terraform provider](https://seekrit.dev/docs/guides/terraform.md): Manage applications, environments, tokens, grants, and secrets as code — with no secret value in Terraform state.
- [Third-party sync](https://seekrit.dev/docs/guides/third-party-sync.md): Push secrets to platforms whose runtime you don't control — Vercel, Cloudflare, AWS, and a dozen more.
  - [Vercel](https://seekrit.dev/docs/guides/third-party-sync/vercel.md): Push a seekrit environment into a Vercel project's environment variables, per deployment target.
  - [Cloudflare](https://seekrit.dev/docs/guides/third-party-sync/cloudflare.md): Push a seekrit environment into Cloudflare Workers secret bindings, Pages environment variables, or an account's Secrets Store.
  - [Railway](https://seekrit.dev/docs/guides/third-party-sync/railway.md): Push a seekrit environment into a Railway service's variables, or an environment's shared variables.
  - [AWS](https://seekrit.dev/docs/guides/third-party-sync/aws.md): Push a seekrit environment into AWS Secrets Manager or SSM Parameter Store, with a least-privilege IAM policy.
  - [Azure Key Vault](https://seekrit.dev/docs/guides/third-party-sync/azure-key-vault.md): Push a seekrit environment into an Azure Key Vault — one vault secret per name, versioned by Key Vault, read by App Service, AKS, or the SDK.
  - [OpenAI Vault](https://seekrit.dev/docs/guides/third-party-sync/openai-vault.md): Push seekrit secrets into OpenAI Vault as host-limited credentials for OpenAI-hosted Agents API sandboxes.
  - [Render](https://seekrit.dev/docs/guides/third-party-sync/render.md): Push a seekrit environment into a Render service's environment variables, or a shared environment group.
  - [Fly.io](https://seekrit.dev/docs/guides/third-party-sync/fly.md): Push a seekrit environment into a Fly.io app's secret set, delivered to Machines as environment variables.
  - [Northflank](https://seekrit.dev/docs/guides/third-party-sync/northflank.md): Push a seekrit environment into a Northflank secret group, inherited by the project's services and jobs.
  - [DigitalOcean](https://seekrit.dev/docs/guides/third-party-sync/digitalocean.md): Push a seekrit environment into a DigitalOcean App Platform app's environment variables, at app or component level.
  - [Heroku](https://seekrit.dev/docs/guides/third-party-sync/heroku.md): Push a seekrit environment into a Heroku app's config vars, delivered to every dyno as environment variables.
  - [Netlify](https://seekrit.dev/docs/guides/third-party-sync/netlify.md): Push a seekrit environment into a Netlify site's environment variables, for the deploy contexts you name.
  - [Bunnyshell](https://seekrit.dev/docs/guides/third-party-sync/bunnyshell.md): Push a seekrit environment into Bunnyshell environment or project variables — including ones that seed environments not yet created.
  - [GitHub Actions](https://seekrit.dev/docs/guides/third-party-sync/github-actions.md): Push a seekrit environment into GitHub Actions secrets — and why the seekrit Action is the better answer for most workflows.
  - [Google Secret Manager](https://seekrit.dev/docs/guides/third-party-sync/google-secret-manager.md): Push a seekrit environment into Google Cloud Secret Manager, one secret per name or as a single JSON bundle.
  - [LangGraph Platform](https://seekrit.dev/docs/guides/third-party-sync/langgraph-platform.md): Push a seekrit environment into a LangGraph Platform (Agent Server) deployment, read by the agent as environment variables.
  - [Hugging Face Spaces](https://seekrit.dev/docs/guides/third-party-sync/huggingface-spaces.md): Push a seekrit environment into a Hugging Face Space's secrets, read by the app as environment variables.
  - [Claude Managed Agents](https://seekrit.dev/docs/guides/third-party-sync/claude-managed-agents.md): Push a seekrit environment into a Claude Managed Agents vault, as credentials an agent can use but never read.
- [Self-hosted provisioner](https://seekrit.dev/docs/guides/provisioner.md): Run the remote executor so seekrit never sees your database admin credential.

## Access & security

- [Service tokens](https://seekrit.dev/docs/guides/service-tokens.md): Machine credentials for CI, Docker, Kubernetes, and agents.
- [Approval workflows](https://seekrit.dev/docs/guides/approvals.md): Require review before a secret in a protected environment changes — without a reviewer ever seeing the value.
- [Honey tokens](https://seekrit.dev/docs/guides/honey-tokens.md): Decoy credentials that unlock nothing and alert you the moment anyone tries to use them.
- [Rotate secrets on a schedule](https://seekrit.dev/docs/guides/rotation.md): Replace a stored credential on a schedule, re-keying the database account with it.
- [Set up recovery](https://seekrit.dev/docs/guides/recovery.md): Configure and exercise customer-controlled M-of-N recovery from the CLI and dashboard.
- [Export & break-glass recovery](https://seekrit.dev/docs/guides/export.md): Take everything out as one signed file, and open it offline — with a passphrase, a token, or a custodian quorum.
- [Managed keys (KMS)](https://seekrit.dev/docs/guides/kms.md): Create managed keys and use them to encrypt, decrypt, and sign.
- [AWS KMS drop-in](https://seekrit.dev/docs/guides/kms-aws.md): Point any AWS SDK at seekrit-kms: KMS-compatible envelope encryption, zero-knowledge.

## Operations

- [Audit log export](https://seekrit.dev/docs/guides/audit-export.md): Stream your audit trail to an OTLP endpoint for SIEM and observability.
- [Telemetry (OpenTelemetry)](https://seekrit.dev/docs/guides/telemetry.md): Export traces, metrics, and logs from the seekrit services you run yourself to your own OTLP collector.
- [Email notifications](https://seekrit.dev/docs/guides/notifications.md): Which transactional emails seekrit sends, and how to manage them.
- [Plans & billing](https://seekrit.dev/docs/guides/billing.md): See your plan and usage, upgrade, and manage payment from the dashboard.

## Reference

- [CLI commands](https://seekrit.dev/docs/reference/cli.md): Every command, flag, and environment variable.
- [REST API](https://seekrit.dev/docs/reference/api.md): Endpoints, auth, and payloads exposed by the API worker.

## Self-hosting

- [Deploy on your infrastructure](https://seekrit.dev/docs/self-hosting.md): Run seekrit in your own Cloudflare account and Postgres database for compliance, residency, or isolation.

## Writing

- [Your agent needs a Disconnect button as much as a Connect button](https://seekrit.dev/blog/agent-account-disconnect.md): Build customer control into your agent's account connections. Seekrit Vault provides manage links, reconnect flows, revocation, and lifecycle events for your product to use.
- [Your agent acts as your users. Their credentials shouldn't live in your database.](https://seekrit.dev/blog/agent-platform-user-credentials.md): Every agent platform that connects a user's Gmail, Notion, or Resend account ends up holding that user's credentials. Seekrit Vault is the drop-in that lets you stop: captured on a hosted page, encrypted to an executor in your own Cloudflare account, applied at the moment of use, never seen by your backend, your agent, or seekrit.
- [How an AI agent can set up its own secrets manager](https://seekrit.dev/blog/agent-sets-up-its-own-secrets-manager.md): Written for the agent doing the work. Connect to mcp.seekrit.dev with no credential, call signup once, store the credentials you were given, run commands with them injected, and hand the org to a human before you stop.
- [Your agent moved to OpenAI. Your keys don't have to.](https://seekrit.dev/blog/agents-api-secrets.md): The Agents API runs the agent loop for you. Its environment choice decides which code can read your credentials, and whether you can keep the real values on infrastructure you control.
- [Your coding agent will hand over your API key if asked nicely](https://seekrit.dev/blog/agents-leak-api-keys.md): A malicious pull-request title was enough to make three major coding agents surrender production credentials. The fix isn't a better agent — it's not giving the agent a credential at all.
- [Deploying AI agents without a secrets plan is how keys leak](https://seekrit.dev/blog/ai-agents-secret-management.md): Agent launch plans cover the model, the tools, the evals, and the cost. Credentials go in a .env file during the prototype and stay there. Why an agent differs from a service, what goes wrong when it ships with standing keys, and how to deploy one that never holds a credential.
- [What happened in the APITemplate.io security incident in October 2026?](https://seekrit.dev/blog/apitemplate-security-incident-october-2026.md): APITemplate's template-rendering breach explained, with a practical Seekrit design that keeps storage-upload credentials outside the document service.
- [Attackers test every key they steal. Give them one that pages you.](https://seekrit.dev/blog/attackers-test-stolen-keys.md): Three separate groups in Anthropic's September 2026 threat report validate harvested credentials in bulk before using them. That validation step is the one moment they touch your infrastructure from the outside — and the only free detection you get.
- [When the site has no API, the signed-in session is the credential](https://seekrit.dev/blog/browser-sessions-as-credentials.md): Half of what a personal agent needs to do happens on sites with no API. Seekrit Vault treats the signed-in browser session as a credential: captured when the person signs in on their own phone, encrypted to your executor, restored into a fenced browser your agent drives, and saved back when it is done.
- [What you would have to build to hold your users' credentials yourself](https://seekrit.dev/blog/build-vs-buy-user-credential-custody.md): An inventory of the system behind 'Connect your account' on an agent platform: capture, consent, key custody, OAuth lifecycle, revocation, end-user controls, webhooks, audit, and the guardrails that keep a prompt-injected agent from walking off with a token. Then the five-step version.
- [A checkpoint is a backup of your API keys](https://seekrit.dev/blog/checkpointed-credentials.md): Sandboxes taught us that secrets inside them are disposable, because the sandbox was. Fly.io Sprites keep their filesystem and snapshot it — so a rotated key comes back on restore. The fix is to stop putting values in the box at all.
- [Clinejection: keep the issue triager away from release credentials](https://seekrit.dev/blog/clinejection-ci-publishing-credentials.md): What the February 2026 Clinejection disclosure and unauthorized Cline CLI release teach about agent API keys, CI isolation, publishing tokens, and verified revocation.
- [Securing AI agents on Cloudflare Workers](https://seekrit.dev/blog/cloudflare-ai-agents-secrets.md): An Agents SDK agent reads its keys from env, one wrangler secret put at a time, and every tool's key sits beside the model key. Four ways to give an agent on Workers its credentials: sync into bindings, resolve from one token, hold a placeholder, or keep the key outside the sandbox with an outbound handler.
- [One token for your Cloudflare Python Worker's secrets](https://seekrit.dev/blog/cloudflare-python-workers-secrets.md): Python Workers are generally available. Resolve Seekrit secrets from one Cloudflare binding with native async fetch, decrypt inside the Worker, and read rotated credentials without a redeploy.
- [Should your coding agent be able to read your .env?](https://seekrit.dev/blog/coding-agents-dotenv.md): Claude Code, Cursor, and Copilot all work in a directory that probably contains production credentials in plaintext. How to block agent access to .env files, why blocking isn't enough, and the setup where there's nothing to block.
- [Credential brokering for AI agents, without running a vault](https://seekrit.dev/blog/credential-brokering-without-a-vault.md): What a credential broker is, what separates one from an open proxy, and the question most comparisons skip: who holds the plaintext behind it.
- [Managing secrets in CrewAI crews](https://seekrit.dev/blog/crewai-secrets.md): How to get API keys into a CrewAI crew without a .env file, and how to stop every agent in the crew from being able to use every tool's credential. Three setups, one command each.
- [CrowdSec's stolen token: when source code becomes a credential inventory](https://seekrit.dev/blog/crowdsec-stolen-token-source-code.md): CrowdSec's September 2026 disclosure shows the consequences of a stolen developer token. Reduce follow-on exposure with secrets outside Git, scoped Seekrit identities, and verified credential rotation.
- [Build the agent's email tool without building a token service](https://seekrit.dev/blog/customer-auth-for-agent-tools.md): Use Seekrit Vault to authenticate agent tools with customer accounts while your team focuses on task logic, approvals, and useful results.
- [Your customer should connect an account, not paste a password into chat](https://seekrit.dev/blog/customer-credentials-out-of-agent-chat.md): Give your agent a way to use customer accounts without collecting credentials in conversation. How Seekrit Vault turns a request for access into a hosted connection flow.
- [Securing self-hosted agent builders: Dify, Langflow, and Flowise](https://seekrit.dev/blog/dify-langflow-flowise-secrets.md): Visual agent builders hold every provider key their flows use, encrypted with one key from the compose file, and an exposed Langflow was enough for unauthenticated remote code execution. How to run them with no secrets in the compose file and route provider calls through a proxy that holds the keys instead.
- [Docker Compose secrets without a .env file](https://seekrit.dev/blog/docker-compose-secrets.md): Where Compose actually puts the values from env_file and environment, why docker compose config and docker inspect print them, and three ways to give containers their credentials at start time with no plaintext file on the host.
- [Secrets in GitHub Actions when an agent writes your workflows](https://seekrit.dev/blog/github-actions-secrets-ai-agents.md): Coding agents write workflow YAML by copying examples, and the common examples expose secrets to pull requests. The two mistakes to check for, and a setup where the runner decrypts a scoped set and nothing else holds it.
- [How to give an AI agent an API key without giving it the API key](https://seekrit.dev/blog/give-an-agent-an-api-key.md): Five ways to get a credential to an agent's work without putting it where the agent can read it — from spawn-time injection to a full egress proxy — and how to pick the right one for your setup.
- [Managing secrets in Google ADK agents](https://seekrit.dev/blog/google-adk-secrets.md): ADK puts GOOGLE_API_KEY in a .env beside agent.py, and every tool's key ends up in the same file. How to wrap adk web, resolve in code, deploy to Cloud Run with one variable, and give tools placeholders instead of keys.
- [Grok Build's repository uploads: keep credentials out of what agents can copy](https://seekrit.dev/blog/grok-build-repository-upload-secrets.md): Lessons from the July 2026 Grok Build upload investigation: remove credentials from Git and agent workspaces, then broker API access with Seekrit outside the agent's process.
- [What happens to your secrets if seekrit disappears](https://seekrit.dev/blog/if-we-disappear.md): Every secrets manager is a single point of failure for everything you deploy. Here is exactly what you keep if we shut down, get acquired, or go dark — and where the answer stops.
- [Secrets in durable agent workflows: Inngest and Trigger.dev](https://seekrit.dev/blog/inngest-trigger-dev-agent-secrets.md): Durable execution stores step outputs and payloads so a run can resume, which means anything a step returns is written to the platform, including a resolved secret. How to give Inngest and Trigger.dev agents credentials that never appear in a payload, an output, or a checkpoint.
- [Syncing secrets into Kubernetes with External Secrets Operator](https://seekrit.dev/blog/kubernetes-external-secrets-operator.md): A step-by-step External Secrets Operator tutorial: install ESO, point a SecretStore at a secrets manager, write an ExternalSecret, and consume the resulting Kubernetes Secret with envFrom. Plus what to do about etcd, refresh timing, and outages.
- [Managing secrets in LangChain agents](https://seekrit.dev/blog/langchain-secrets.md): LangChain 1.x agents in Python and JavaScript read provider keys from the environment, and LangSmith adds a second one. Four shapes for getting credentials into create_agent and createAgent, from wrapping the process to middleware that lets one tool spend a key the others cannot.
- [Managing secrets in LangGraph agents](https://seekrit.dev/blog/langgraph-secrets.md): Four ways to get credentials into a LangGraph agent, from wrapping the process to scoping a Stripe key to a single tool call with LangChain middleware — and why CVE-2025-68664 is the argument for the stronger two.
- [Managing secrets in Mastra agents](https://seekrit.dev/blog/mastra-secrets.md): Five ways to get credentials into a Mastra agent: wrap mastra dev, resolve in code, hold a placeholder, resolve a different key per tenant from requestContext, and scope a Stripe key to one createTool executor.
- [Your MCP config is a plaintext secrets file](https://seekrit.dev/blog/mcp-config-plaintext-secrets.md): claude_desktop_config.json, .mcp.json, and most MCP server READMEs tell you to paste API keys into an env block. How to configure MCP servers so the file names credentials instead of holding them.
- [One agent product, a different account for every customer](https://seekrit.dev/blog/multi-tenant-agent-customer-auth.md): How Seekrit Vault helps a multi-tenant agent use each customer's own credentials, with explicit connection ownership and authentication kept outside model state.
- [Securing n8n AI agent workflows](https://seekrit.dev/blog/n8n-ai-agent-secrets.md): Self-hosted n8n holds every credential your workflows use, encrypted with one key, and an AI Agent node acts on whatever it reads. How to run n8n with no secrets in the compose file, keep the encryption key off the host, and give the agent's tools placeholders instead of keys.
- [Neocloud security is now an API key problem](https://seekrit.dev/blog/neocloud-api-keys.md): A summer of neocloud security research found cross-tenant credential exposure, container escapes, and monitoring stacks that leaked every tenant at once. If you rent GPUs, the question is no longer whether you handled your keys well — it's what happens to them when the provider's isolation fails.
- [The hard part of "connect your Gmail" is the refresh token](https://seekrit.dev/blog/oauth-refresh-tokens-agents.md): The consent screen takes an afternoon. Keeping a user's OAuth grant alive for a year — refresh races, single-use refresh tokens, a Worker that dies mid-exchange — is where agent platforms lose months. How Seekrit Vault's executor handles it, and why your code never sees a token.
- [After this week's breaches, where should your API keys live?](https://seekrit.dev/blog/october-2026-api-key-security-roundup.md): Railway, OpenCode, APITemplate, and LiteLLM put credential exposure in focus. What was disclosed, what to check, and how to keep keys outside an application's reach.
- [Securing Open WebUI and Ollama deployments](https://seekrit.dev/blog/open-webui-ollama-secrets.md): Open WebUI is where a self-hosted chat stack collects its keys: OpenAI-compatible providers, web search, tool servers, the JWT signing secret. How to run it with one credential in the compose file, put a proxy between it and every paid API, and stop admin-panel edits from bypassing that proxy.
- [Managing secrets in the OpenAI Agents SDK](https://seekrit.dev/blog/openai-agents-sdk-secrets.md): How to run an OpenAI Agents SDK agent on injected secrets or behind a credential proxy with no code change, and why traces disappear the moment you add the proxy.
- [What happened in the OpenCode security incident in October 2026?](https://seekrit.dev/blog/opencode-security-incident-october-2026.md): The OpenCode Console breach explained: reported scope, the limits of the distillation claim, provider-key custody, and how a separate Seekrit broker helps.
- [Managing secrets in Pydantic AI agents](https://seekrit.dev/blog/pydantic-ai-secrets.md): Pydantic AI's deps_type and RunContext are a per-run credential seam. How to resolve a tenant's secrets per run, hold a placeholder instead of a key, and let one tool use a Stripe key while the others cannot.
- [Managing secrets in a Python app without a .env file](https://seekrit.dev/blog/python-secrets-management.md): Where python-dotenv and pydantic-settings fall short, and how to load API keys and database URLs into a Python process at startup from an encrypted store. Covers scripts, FastAPI, Django, pytest, and notebooks.
- [Managing secrets in Ruby on Rails without dotenv or credentials.yml.enc](https://seekrit.dev/blog/rails-secrets.md): Rails gives you encrypted credentials and RAILS_MASTER_KEY, most teams add dotenv-rails on top, and the two drift. How to load ENV for Puma, Sidekiq, rake tasks, and Kamal from one encrypted store, with a Railtie or a wrapper command.
- [Railway's disclosure asks a harder question: who can decrypt your secrets?](https://seekrit.dev/blog/railway-incident-secret-custody.md): What Railway's October 21 disclosure tells us about secret custody, and how to use Seekrit to keep upstream credentials outside a hosting platform's reach.
- [What happened in the Railway security incident in October 2026?](https://seekrit.dev/blog/railway-security-incident-october-2026.md): A sourced report on Railway's October 21, 2026 security disclosure: the timeline, known impact, unanswered questions, and how Seekrit can limit credential exposure.
- [Keep the app on Railway. Keep its API keys outside Railway.](https://seekrit.dev/blog/railway-seekrit-deployment-patterns.md): A practical Seekrit deployment plan after Railway's October 21 disclosure: compare sync, runtime injection, and a separately hosted credential broker.
- [Your GPU node lives for an hour. Your API key lives for a year.](https://seekrit.dev/blog/rented-gpu-secrets.md): Renting compute by the hour inverts the usual lifetimes: the machine is disposable and the credential isn't. On SF Compute the only thing you can put on a node before it boots is a cloud-init script the provider keeps — so make it carry one credential, not twenty.
- [Passing secrets into a sandbox without baking them into the image](https://seekrit.dev/blog/sandbox-secrets.md): ENV in a Dockerfile, a copied .env, an ARG in build history — every baked-in credential outlives the build. How to inject secrets at start time in Docker, E2B, Modal, Daytona, and Vercel Sandbox, and when to keep them out of the sandbox entirely.
- [Secrets at the edge: why a decrypting server can't scale the way a ciphertext-only one does](https://seekrit.dev/blog/secrets-at-the-edge.md): Every workload fetches its secrets at boot. If the server decrypts them, that response can't be cached and always travels to one region. If the server holds only ciphertext, the hot path can run at the edge. How that decision, not tuning, sets a secrets manager's ceiling, and what the zero-knowledge version is like to use.
- [Getting secrets into a Jupyter notebook without leaking them](https://seekrit.dev/blog/secrets-in-jupyter-notebooks.md): Every common way of getting a credential into a notebook either writes it into the .ipynb or only works on one platform. One call that works the same in JupyterLab, papermill, Voilà, and a container.
- [Managing secrets in Spin applications](https://seekrit.dev/blog/spin-secrets.md): How to get credentials into a Spin component without the Spin host ever holding one, and the WASI version mismatch that makes the obvious setup fail at startup with an error that names neither Spin nor seekrit.
- [Your stolen API key is someone else's compute budget](https://seekrit.dev/blog/stolen-keys-attack-compute.md): Anthropic's September 2026 threat report describes attackers stealing AI credentials to run their attacks on the victim's bill, under the victim's name. Every one of those keys was reusable plaintext sitting somewhere readable.
- [Securing an AI agent in Supabase Edge Functions](https://seekrit.dev/blog/supabase-edge-functions-agent-secrets.md): Every Edge Function gets the service role key injected by default, and an agent in one holds it alongside every provider key set with supabase secrets set. How to run an agent on Supabase with one secret, placeholders for tool keys, and the database reached as the user rather than as the service role.
- [Keeping secrets out of Terraform state](https://seekrit.dev/blog/terraform-secrets-state.md): Terraform writes every attribute it manages into terraform.tfstate, sensitive or not. How to use write-only arguments and ephemeral resources (Terraform 1.11+) so database passwords and API keys never land in state or a plan file.
- [Three hours from one developer token to full cloud admin](https://seekrit.dev/blog/three-hours-to-admin.md): Anthropic's September 2026 threat report measures modern intrusions in hours. Most credential lifetimes are still measured in quarters. Rotating faster doesn't close that gap — not issuing long-lived credentials does.
- [Two breaches and still no credential: how Vault's custody works](https://seekrit.dev/blog/vault-trust-model.md): A breach of seekrit yields ciphertext nobody can open. A breach of your backend yields a key that cannot release anything. Here is why both hold, where each guarantee comes from, and the design rule every boundary follows.
- [Securing AI agents on Vercel](https://seekrit.dev/blog/vercel-ai-agents-secrets.md): A Vercel Function has no process to wrap and reads its environment from Vercel's copy. How to run an agent on Vercel with one credential in the project instead of every key, keep tool keys out of traces, let the browser hold a placeholder, and run agent-generated code in a sandbox that never sees a key.
- [Syncing environment variables to Vercel from one source of truth](https://seekrit.dev/blog/vercel-environment-variables-sync.md): Vercel injects env vars from its own copy at build and run time, so a secrets manager has to push to it. How to connect a Vercel project, bind an environment per deployment target, handle preview branches, and what Vercel can see.
- [Vite environment variables: keeping API keys out of the bundle](https://seekrit.dev/blog/vite-env-variables-secrets.md): How Vite decides which env vars end up in your JavaScript bundle, why a .env file is the wrong place to draw that line, and how to load secrets into vite.config.ts, SSR, and Vitest without one.
- [Managing secrets in wasmCloud](https://seekrit.dev/blog/wasmcloud-secrets.md): wasmCloud has a pluggable secrets API, which makes it the rare WebAssembly host where the platform can refuse to spread a plaintext. What that buys you, what the nkeys trust model actually proves, and the two setup steps that fail silently.
- [Every place a secret ends up, and what each one costs you](https://seekrit.dev/blog/where-secrets-end-up.md): You never decide to spread credentials around. It happens one reasonable step at a time: a .env file, a CI variable, a container env, a Terraform apply, an agent. What each stop exposes, and how to keep the plaintext from settling anywhere.

## Comparisons

- [seekrit vs Infisical agent-vault](https://seekrit.dev/compare/agent-vault.md): Both keep API keys out of your AI agents by substituting placeholders at the network boundary. Where they differ is what sits behind the broker — who runs it, who can decrypt it, and what happens when one agent becomes fifty.
- [seekrit vs Doppler](https://seekrit.dev/compare/doppler.md): Doppler's service can decrypt your secrets, because most of what it does needs that. seekrit's cannot. What that buys, what it costs, and why the difference gets sharper once AI agents are the ones holding credentials.

## Optional

- [Full documentation, single file](https://seekrit.dev/llms-full.txt): every page concatenated