Vault documentation
Vault stores and signs the keys AI agents use. The design principle is simple: the agent should not hold the secret.
An agent that never receives a raw key cannot leak it into a log, a prompt, or a commit — which are the three ways agents actually leak credentials.
Concepts
Organisation
The tenant. Secrets, keys, agents and credentials all belong to one organisation and are never visible across organisations.
Secret
An encrypted value. Stored at rest encrypted; retrieval is scoped and recorded.
Signing key
A key that never leaves Vault. You send a payload; Vault returns a signature. The requester never receives the key material.
Agent
A registered non-human identity with its own credentials and its own scope of access.
Credential
The scoped grant that lets a specific agent reach a specific secret or key — not a blanket permission over the organisation.
Sign, do not share
The most valuable thing Vault does is refuse to give the agent the key. For anything cryptographic, send the payload to the key rather than the key to the agent: Vault signs and returns the signature.
This turns a permanent compromise into a temporary one. If an agent is compromised, an attacker can request signatures while the access lasts, but they cannot walk away with a credential that stays valid after you revoke it.
Operating rules
Scope per agent, per task
A credential should do one job. Broad credentials turn one compromise into total compromise.
Rotate on a schedule and on suspicion
Rotation bounds the useful life of a leak nobody has detected yet.
Record every sensitive action
Who asked, for what, when, and whether it was allowed. You cannot investigate what you did not record.
Never expose secrets to the client
Anything a frontend framework marks as publicly exposed is public. Enforce this at build time rather than in code review.
The same principle inside Empyre
Empyre applies this to the companies it generates. Each company has an encrypted environment vault: values are encrypted at rest, and the AI agents working on the product see key names but never values.
Platform-managed keys go further — they are hidden from the founder's own vault interface and cannot be overwritten or deleted through it, because silently replacing a company's authentication key would break every account in that product.
Frequently asked questions
How do AI agents securely store API keys?
Ideally they do not store them at all. Keys live in Vault; the agent receives a scoped, short-lived grant or a signature. If an agent must hold a key, it should be narrowly scoped, short-lived, rotated, and never written into logs or prompts.
How does Vault compare to Doppler or Infisical?
Doppler and Infisical are mature secret managers aimed at applications and CI — syncing configuration into environments. If that is your problem they are likely the better fit. Vault is narrower and aimed at agents: signing on behalf of a key so the requester never receives it, per-agent scoping, and an access record. Running both is reasonable.
Is an environment variable good enough?
For a conventional server process, it is a reasonable baseline. For an agent it is weaker than it looks, because the agent's own error handling and context assembly can surface the process environment into a prompt or a log line.
Can I use Vault without Empyre?
Yes. Vault is a separate product with its own pricing and dashboard. It shares the Empyre account system, so one login works for all three products.
Vault — key storage and signing for AI agents
Keys stay encrypted. Agents get access or a signature, never the raw secret, and every sensitive action is recorded.