Secrets

Manage encrypted AI provider keys, webhook signing secrets, and third-party credentials in Supabase Vault.

Overview

The Asiyst Secrets Vault stores sensitive third-party credentials (OpenAI API keys, Anthropic tokens, database connection URLs) using hardware-level envelope encryption.

Hardware Security Module (Vault) Storage

Secrets are encrypted with unique AES-256-GCM data keys.

Data keys are wrapped by a master Key Encryption Key (KEK) managed in cloud HSMs.

Secrets are decrypted only inside memory-isolated worker runtimes during LLM inference.

Storing & Updating Secrets via CLI

# Store an Anthropic API Key securely in project vault

asiyst secrets set ANTHROPIC_API_KEY="sk-ant-api03-..." --project proj_9f8a2b3c4d