Credential vault
Write only. Reads give you a name, a four character preview, and when it was set.
Per client keys
Each client key is derived through HKDF from a master key held in the environment. One client key cannot decrypt another client secrets.
A nonce per secret, and the envelope records its own version
Every secret is encrypted under a fresh random nonce, so storing the same value twice produces two different ciphertexts and nothing can be inferred by comparing rows. The stored envelope carries its algorithm and a version number, which is what makes it possible to rotate the scheme later without guessing how an old record was written.
Tampering fails loudly rather than silently
AES-256-GCM is authenticated, so a ciphertext that has been altered does not decrypt to nonsense, it refuses to decrypt at all. The same property means a secret encrypted for one client cannot be decrypted under another client key, because the key is derived from the client identity and the wrong key fails the authentication tag rather than returning a wrong answer.
No read path exists
This is not a permission setting. There is no endpoint that returns a decrypted secret, so there is nothing to misconfigure. If you lose a credential you rotate it at the source and set it again.
Questions
What if I need to see the key I stored?
You cannot, and neither can we. Rotate it with the provider and store the new one. The preview and timestamp are there so you can tell which key is loaded.
More in Connect and scale
- Six engines, live answers
AI engine tracking
We run real prompts against six consumer answer engines and record whether you were mentioned, where in the answer, in what tone, and which sources were cited.
Read more - OAuth connection, real API reads
Search Console and GA4
Connect Search Console and Google Analytics 4 so ranking and traffic data sit next to the audit findings instead of in another tab.
Read more - Tenant id is the first argument, always
Client workspaces
Every client is a tenant. Isolation is enforced by the shape of the code, not by remembering to filter, and a record belonging to another client answers 404.
Read more
Run it against your own site.
No signup, no card. It reports what it could not check as well as what it found.