Give agents a free hand.
Not your keys.
Vault gives an AI agent access to tokens, service accounts and services without letting it read, copy or misuse the credentials. It works with the access you grant; the keys themselves stay out of its hands.
That means less worrying about what an agent is reading, and no more cleaning tokens out of files, logs and chat histories.
Like a valet key
It starts the car, but cannot open the glove compartment — and only works today. Your agent gets access the same way: just for its task, and just for a limited time.
Any token an agent can see can be read, logged or passed on.
Giving an agent access to Git, a build system or the cloud usually means handing over the key itself — in a file, an environment variable or a chat. From then on, it can see it.
For anyone letting coding agents do real work.
For people who let coding agents push code, open pull requests and check tests — without wanting to watch every step.
Let agents work freely
Pushes, pull requests and test runs just happen — without you checking what the agent is reading.
Approve once, not a hundred times
Confirm with a fingerprint on your phone when access starts — rather than at every individual step.
Nothing to leak
What the agent has never seen cannot end up in its output, logs, files or replies.
Three steps. The agent never sees the key.
In detail: who can read the value?
- In transit (through the hub and the service on the server), only encrypted data travels. Only the key manager can decrypt it.
- The key manager is a small, separate service with its own user account. It keeps values in memory only, never on disk.
- The agent runs separately and is designed to never see a value — in files, environment variables or output.
agent $ git push ✓ main → main # The manager supplies the credentials agent $ ci-status ✓ Build · Tests passed agent $ env | grep -i token # (nothing) # … access expired … agent $ git push ✕ VAULT_LOCKED # locked, waiting for your approval agent $
// the agent may
- Fetch and push code — only in repositories you approve
- View test runs, open and comment on pull requests
- Run pre-approved commands; secrets are removed from the output
// the agent does not get
- The token, password or key itself
- Unrestricted calls, deletions or workflow changes
- Access unrelated to its task
Git credentials expire automatically after an hour and renew themselves.
Other access lasts for a working day. After that, it is locked.
per start or expiry — not per action. A restart means locked.
Honestly: whoever controls the server controls everything.
Vault protects your credentials from the agent — not from someone who takes over the entire server.
The value is briefly readable when stored.
The storage service sees it while encrypting it. The next stage changes that.
The next stages
A key manager alongside the agent, with credentials held only in memory and for a limited time.
Every action is recorded: when, where and with what result — never the secret value.
More providers beyond Git and test runs, each with a narrow list of permitted actions.
A value becomes readable only on your own device — even the storage service will no longer see it.