Skip to main content

Vault

Keyless Vault stores secrets encrypted to a wallet.

Mental model​

  1. You encrypt a secret to your wallet
  2. Keyless stores ciphertext (encrypted at rest)
  3. Decrypt requires wallet authorization (wallet-only decrypt)
  4. Apps/agents fetch secrets just-in-time

Why this matters​

  • No more copying long-lived keys into prompts or logs
  • Centralized rotation and revocation
  • Clear “who can access what” via provider names and scopes

Best practices​

  • Prefer scoped and short-lived credentials when providers support it
  • Never return raw keys to untrusted clients
  • Treat KEYLESS_API as a server secret (same tier as a database password)