Agent Secret Store
Secure Credential Vault for AI Agents

The Vault Built for AI Agents

Stop embedding raw API keys in your agent code. Issue scoped, short-lived tokens. Enforce human-in-the-loop approvals. Audit every credential access — automatically.

✦ HSM-backed encryption✦ SOC 2 roadmap✦ MCP-native✦ No credit card required
vault_client.py
vault connected
from agentsecretstore import AgentVault
vault = AgentVault(
agent_key=os.environ["ASS_AGENT_KEY"]
)
# Scoped token — expires in 1 hour
api_key = await vault.get_secret(
"production/openai/OPENAI_API_KEY"
)
# Raw key never leaves the vault
print("Secret retrieved — agent has scoped access")
Python
AES-256-GCM·TLS 1.3·token scoped

How It Works

Four steps from setup to production

Agent Secret Store slots into any agentic stack in under five minutes. No infrastructure to manage.

01

Store

Drop secrets into namespaced vaults — API keys, OAuth tokens, database URLs. Envelope-encrypted with per-tenant KMS keys.

02

Scope

Issue short-lived agent tokens with path-level access. No agent ever sees the raw secret — only a time-limited token to retrieve it.

03

Approve

Route sensitive secret requests through human-in-the-loop approval. Set policies per namespace, per agent, or per environment.

04

Audit

Every access is logged with agent identity, timestamp, IP, and approval status. Export to SIEM or compliance tools in one click.

Works with every agent framework

Your stack. Your agents. Any runtime.

OpenClaw
LangChain
CrewAI
AutoGen
OpenAI Assistants
Claude
Cursor
Any MCP Agent

Native MCP server at mcp.agentsecretstore.com/sse — drop into any MCP host config.

Features

Built security-first, agent-native

Everything your agents need to handle credentials safely in production — without compromising speed or developer ergonomics.

Scoped Short-Lived Tokens

Agents never touch raw secrets. They receive time-limited, path-scoped tokens — automatically invalidated at expiry.

const token = await vault.issueToken({
path: "prod/stripe/*",
ttl: 3600, // 1 hour
})

Human-in-the-Loop Approval

Flag high-risk namespaces for approval. Agents pause, humans approve in Slack or dashboard, agents resume — all logged.

# Requires approval for prod secrets
secret = await vault
.get_secret(
"prod/stripe/SECRET",
require_approval=True
)

Forensic Audit Trail

Every access emits an immutable log entry with agent ID, token, timestamp, IP, and approval chain. Compliance-ready exports.

// Audit entry (auto-generated)
{
agent: "agt_prod_9x2k",
path: "prod/openai/key",
status: "approved",
ttl: 3600
}

Security Architecture

Trust built in, not bolted on

Agent Secret Store is engineered from first principles for the threat model of autonomous agents — where a compromised credential can cascade across an entire fleet.

AES-256-GCM
at-rest encryption
TLS 1.3
in-transit encryption
FIPS 140-2 L3
HSM standard
< 50ms
p99 token issuance

HSM-Backed Encryption

All keys managed in FIPS 140-2 Level 3 Hardware Security Modules via GCP Cloud KMS. Your data never exists unencrypted at rest.

Envelope Encryption

Per-tenant Key Encryption Keys (KEK) and per-secret Data Encryption Keys (DEK). AES-256-GCM everywhere. Full key isolation.

Tenant Isolation

Every query is scoped by tenant_id at the database layer. No shared state between tenants. Dedicated encryption contexts.

SOC 2 Roadmap

Audit logging, access controls, and incident response procedures are designed from day one to support SOC 2 Type II certification.

Pricing

Start free. Scale as you grow.

No credit card required to start. Usage-based pricing that grows with your agent fleet.

Starter

$0forever
  • 1 agent
  • 10 secrets
  • 1,000 API calls/mo
  • MCP server access
  • Community support
Get started free

Growth

Popular
$49/month
  • 25 agents
  • 500 secrets
  • 100,000 API calls/mo
  • Approval workflows
  • Audit log exports
  • Email support
Get started free

Enterprise

Custom
  • Unlimited agents & secrets
  • HSM key isolation
  • SSO + SCIM
  • SLA guarantee
  • Dedicated support
  • Custom contracts
Contact sales

Ready to ship?

Every agent in production deserves a vault

Join the teams building the agentic economy with credentials that never compromise. Set up your first vault in under five minutes.

MCP server · pip install agentsecretstore · npm i @agentsecretstore/sdk