> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> AIRCTRL is a zero-knowledge secrets manager. Your secrets are encrypted on your device, and the backend never sees them in plaintext.

AIRCTRL stores, shares, and rotates the credentials your applications depend on — API keys, database passwords, certificates, SSH keys, OAuth clients, and more.

The difference is where the encryption happens. Secrets are encrypted **on your device**, before anything leaves it. AIRCTRL's servers store ciphertext they cannot read.

## How the encryption works

Every secret is protected by a layered key hierarchy:

```
your passphrase → master key → vault key → data key → your secret
```

Each layer only unwraps the one below it, and all of it happens on your device. Rotating your passphrase re-wraps the keys above it — it never re-encrypts the secrets themselves.

Sharing a secret with a teammate does not expose it to the server either: the data key is re-wrapped for that person's public key, so only they can open it.

## What you can do with it

* **Organize secrets** into projects, with role-based access for each member.
* **Share and revoke** access per secret, without ever handing over your passphrase.
* **Track every access** in a tamper-evident audit log — each entry is chained to the one before it, so silent edits are detectable.
* **Route AI provider traffic** through a gateway that injects your provider keys at request time, so they never reach client code.
* **Automate** from your own systems using the SDK, the CLI, or the MCP server.

## Start building

> **[Quickstart](https://docs.airctrl.dev/getting-started/quickstart.md)**
>
> Authenticate and list the projects you can access.

> **[SDK](https://docs.airctrl.dev/sdk/overview.md)**
>
> Use the typed client from TypeScript or JavaScript.

> **[CLI](https://docs.airctrl.dev/cli/overview.md)**
>
> Inject encrypted records into a process without a local `.env` file.

> **[MCP](https://docs.airctrl.dev/mcp/setup.md)**
>
> Connect AIRCTRL to an MCP-compatible agent.

## Core guides

* [Combine AIRCTRL tools](https://docs.airctrl.dev/guides/tool-workflows.md): use the dashboard, CLI, SDK and MCP together in real development workflows.
* [Projects](https://docs.airctrl.dev/guides/projects.md): discover, create, update and archive project workspaces.
* [Records and secrets](https://docs.airctrl.dev/guides/records.md): create, decrypt, inject, rotate and share records.
* [AI gateways](https://docs.airctrl.dev/guides/gateways.md): configure providers, routing, tokens, limits and observability.
* [Service Accounts](https://docs.airctrl.dev/guides/service-accounts.md): run unattended workloads with least privilege.

The [API Reference](https://docs.airctrl.dev/api-reference/audit/list-record-anomalies.md) is generated from the current public API contract. It includes request schemas, success envelopes, common errors and authentication requirements.

## Getting access

AIRCTRL is available at [app.airctrl.dev](https://app.airctrl.dev).

Need a hand? Write to [support@airctrl.dev](mailto:support@airctrl.dev).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.