Stop pasting API keys into your AI agent.

creds-vault is the secrets broker we use internally. Your keys sit encrypted on your own machine, and your coding agent fetches them by name at the moment it needs one. Free, MIT licensed, and it never touches the internet.

A PowerShell session: a key is stored with creds set, creds list prints only the key names, and a mistyped name is answered with a did-you-mean suggestion. — Real output, not a mockup.

01 THE PROBLEM

Every one of these leaks a key eventually.

If you build with Claude Code, Cursor, Codex or Copilot, you hand over credentials constantly. The usual habits all end the same way.

Pasting it into the chatIt is now in a transcript, and probably in a model provider's logs.
Dropping it in .envOne git add . from being public, and git history keeps it forever.
Keeping a credentials filePlaintext on disk, readable by anything running as you.
Hardcoding itIt ships to production and to GitHub at the same time.
Environment variablesThey leak into child processes, crash dumps and CI logs.

02 THE FIX

Files hold the key name. Never the key.

A commit can safely say creds get stripe-secret-key, because the value is not there. It is fetched from the vault at the second it is used, and every fetch is written to an audit log.

Two routes for the same key. Without a vault it travels through chat transcripts, .env files, git history and CI logs, and leaks. With creds-vault the agent asks by name, the vault decrypts it, and the value is used and gone without ever reaching disk. — The same key, two routes. Only one ends well.

Encryption: Windows DPAPITied to your Windows account. A copied store file will not decrypt on another machine or another user.
Network: None, everNo cloud, no account, no sign up. Encryption happens locally inside Windows.
Footprint: One Python fileNo third party packages to install and nothing to keep updated.
Audit: Every access loggedWhich key, when, and which process asked for it.
Agents: Drop in rules fileOne block to paste into CLAUDE.md, .cursorrules or AGENTS.md.
Licence: MITUse it, fork it, ship it commercially. No attribution required.

03 GET IT

Send it to my inbox.

Give us an email and the tool plus the four step setup lands there in about a minute. It is also public on GitHub, so this is for convenience, not a gate.

Personal inboxes only / Gmail, Outlook, Proton, iCloud and the like / No temporary addresses / One email, no list, unsubscribe not needed

Sent. Check your inbox.

It should land within a minute. If it is not there, look in spam and mark it as not spam, so the rest actually reaches you.

Want the repo right now instead of waiting?

Open it on GitHub ↗

04 WHO MADE IT

We build the automation, then we give the tools away.

creds-vault came out of our own work: we run a lot of AI agents across a lot of client systems, and needed them to stop asking for keys. It is one small piece of what we build. If your business has a job being done by hand that a system should be doing, that is the actual work.

See what we have shipped ↗

05 BEGIN

A GOOD PLACE TO START

Want this kind of
thing built for you?

Book a free automation audit

15 MINUTES / NO COMMITMENT / A PRACTICAL PLAN