HOW IT WORKS

Three calls. That's the whole API.

No SDK, no client library, no lock-in — every operation is a plain HTTP request with headers.

01

Create a secret

Send a name, a value, and your access key. It's encrypted with Fernet before it ever touches disk.

$ curl -X POST .../api/create-secret/ \
    -H "access-key: $ACCESS_KEY" \
    -H "secret-name: DATABASE_PASSWORD" \
    -H "secret-value: ..."
02

Retrieve it, from anywhere

Any service, any language — it's just HTTP headers. No SDK lock-in required.

$ curl .../api/get-secret/ \
    -H "access-key: $ACCESS_KEY" \
    -H "secret-name: DATABASE_PASSWORD"
03

Update or delete it

Same shape, different verb — PUT to rotate a value, DELETE to remove it.

$ curl -X PUT .../api/update-secret/ \
    -H "access-key: $ACCESS_KEY" \
    -H "secret-name: DATABASE_PASSWORD" \
    -H "secret-value: ..."

UNDER THE HOOD

Every request is checked, scoped, and logged.

1. Rate limit

Per-IP limits reject abusive traffic before it reaches auth.

2. Authenticate

Access key validated via O(1) hash lookup, then checked against the IP allowlist.

3. Execute

Secret is encrypted or decrypted with Fernet, scoped to the key's owner.

4. Audit

The outcome — success or failure — is written to the audit log.

See the full feature set

Encryption, allowlisting, rate limits, and observability — all in the core service.

View features Read the documentation