API keys and tokens
Store service tokens with the account and environment they belong to.
Secrets Manager for developers
Stop committing secrets. Share them safely.
Keep API keys, SSH keys, database credentials and certificates in encrypted workspaces with roles and expiry. Use the ciphertext-only CLI and API to automate — without handing plaintext to our servers.
Client-side encryption Ciphertext-only CLI Per-workspace keys
SSH keys and hosts
Keep private keys or references next to the hosts and users they unlock.
Database credentials
Connection details and passwords for every environment, shared by role.
Certificates and files
Encrypted attachments for certificates, key files and configuration.
Missions
Time-boxed task access: open exactly the secrets a deploy or incident needs.
Expiring access
Give contractors access that expires automatically, and review it quarterly.
Automation
Built for pipelines, not just people.
The REST API and CLI move ciphertext. Decryption happens where the key lives — on a trusted device — so a leaked token never exposes plaintext at rest.
- Versioned REST API with an OpenAPI description
- Ciphertext-only command-line client
- Tamper-evident audit of every secret reveal
Questions
Frequently asked
Does the CLI send plaintext to Passkey-X?
No. The CLI handles ciphertext; decryption requires keys held by the user or device.
Can I use it for CI/CD?
Yes. Agents are read-only service identities for scripts and CI (2 on Team, 10 on Business, unlimited on Enterprise), and Missions and expiring access cover people. The CLI injects secrets at run time without writing them to disk.
See it with your own data.
Start free in minutes, or book a walkthrough for your team.