Skip to main content
stores, shares, and rotates the credentials your applications depend on — API keys, database passwords, certificates, SSH keys, OAuth clients, and more. The difference is where the encryption happens. Secrets are encrypted on your device, before anything leaves it. ’s servers store ciphertext they cannot read.

​
How the encryption works

Every secret is protected by a layered key hierarchy:
Each layer only unwraps the one below it, and all of it happens on your device. Rotating your passphrase re-wraps the keys above it — it never re-encrypts the secrets themselves. Sharing a secret with a teammate does not expose it to the server either: the data key is re-wrapped for that person’s public key, so only they can open it.

​
What you can do with it

  • Organize secrets into projects, with role-based access for each member.
  • Share and revoke access per secret, without ever handing over your passphrase.
  • Track every access in a tamper-evident audit log — each entry is chained to the one before it, so silent edits are detectable.
  • Route AI provider traffic through a gateway that injects your provider keys at request time, so they never reach client code.
  • Automate from your own systems using the SDK, the CLI, or the MCP server.

​
Start building

Quickstart

Authenticate and list the projects you can access.

SDK

Use the typed client from TypeScript or JavaScript.

CLI

Inject encrypted records into a process without a local .env file.

MCP

Connect to an MCP-compatible agent.

​
Core guides

  • Combine tools: use the dashboard, CLI, SDK and MCP together in real development workflows.
  • Projects: discover, create, update and archive project workspaces.
  • Records and secrets: create, decrypt, inject, rotate and share records.
  • AI gateways: configure providers, routing, tokens, limits and observability.
  • Service Accounts: run unattended workloads with least privilege.
The API Reference is generated from the current public API contract. It includes request schemas, success envelopes, common errors and authentication requirements.

​
Getting access

is available at app.airctrl.dev. Need a hand? Write to support@airctrl.dev.