No more .env files in Slack. No more plain text credentials in logs. Your agents store secrets encrypted — flip on zero-knowledge modeIn plain English: your secret is scrambled on your machine before it ever reaches us. We only store the scrambled blob and never hold the key to unlock it — so even we can't read it, and a database breach leaks only gibberish. and even we can't read them: the server only ever sees ciphertext. Rotate on schedule, share via claim tokens. One CLI command to start.
$ npm install -g secretcarousel
Your agents handle the entire secret lifecycle. You monitor and approve.
"Your agent encrypts it, retrieves it, versions it."
# Agent self-signup (zero friction)
$ sc signup my-app --local
# Tenant "my-app" created! Key saved to .sc/config.json
# Store a secret (AES-256-GCM encrypted)
$ sc secret "DB_PASSWORD" "s3cur3!" -t database-credentials
# Secret created. Encrypted, versioned, audit-logged.
"Set a schedule. Agent rotates. Webhook fires. CI/CD picks up."
# Set 30-day rotation policy
$ sc rotate set sec-abc --schedule "30d" --email ops@co.dev
# Day 30: auto-rotated, new version
# Webhook fires. CI/CD picks up new credential.
# Or rotate immediately
$ sc rotate sec-abc
"Agent A creates claim token. Agent B claims. Auto-revoked."
# Agent A: create claim token for partner
$ sc claim "sk_live_xxx" --to partner-app --contract ctr_abc
# Claim token: ctk_abc123... (expires in 5 min)
# Agent B: claim and auto-store in vault
$ sc claim redeem ctk_abc123
# Secret claimed and stored. ID: sec-xyz
Real terminal sessions against a live vault — no mockups. Pick a scenario below.
Solo, team, and cross-company — all agent-first.
Self-signup in <1s. Store, retrieve, rotate, share — all via API. Zero-friction. No dashboard required.
Project scoping, RBAC API keys, webhooks, audit trail. Each agent gets its own key with granular permissions.
Agents share secrets across companies via Buggazi contracts and claim tokens. Encrypted in transit and at rest.
Your agent runs one command. Plain text credentials are gone.
# Install + signup (instant API key, saved to project)
$ npx secretcarousel signup my-project --local
# Tenant "my-project" created!
# API Key: sc_trial_my_project_a1b2c3...
# Saved: .sc/config.json (local)# Store a secret (AES-256-GCM encrypted at rest)
$ sc secret "DATABASE_URL" "postgres://user:pass@host/db" -t database-credentials
# Secret created
# ID: secret-abc123
# Name: DATABASE_URL
# Type: database-credentials# Retrieve (decrypted on demand, access logged)
$ sc secret show secret-abc123
# DATABASE_URL database-credentials active
# Value: postgres://user:pass@host/db
# Version: 1 Accessed: 1x# Set 30-day rotation (fires webhook on rotate)
$ sc rotate set secret-abc123 --schedule "30d" --email ops@myproject.dev
# Or rotate immediately
$ sc rotate secret-abc123
# Rotated secret-abc123Claude Code, Cursor, Cline, Windsurf, Aider - any agent that can run a CLI command.
Other secret managers require IAM consoles, KMS config, and human setup. SecretCarousel is one CLI command. Your agent self-provisions and starts encrypting.
| Capability | SecretCarousel | AWS Secrets Manager | HashiCorp Vault | Doppler |
|---|---|---|---|---|
| Agent Self-Signup | sc signup (1 cmd) | No (IAM console) | No (admin config) | No (dashboard) |
| Pricing Model | From $9/mo, 7-day trial — no seats | $0.40/secret/mo, no free tier | Cluster license (HCP Secrets retired) | $21/human/mo |
| Cross-Agent Key Exchange | Claim tokens | No | No | No |
| Per-Secret Encryption | Unique key per secret (AES-256-GCM) | Shared KMS key | Transit engine | At rest only |
| Immutable Audit Trail | Every op logged | CloudTrail (separate) | Audit device (config) | Basic logs |
| Setup Time | <1 second | Hours (IAM + KMS) | Days (cluster) | Minutes (dashboard) |
| Self-Hostable | Docker | No | Yes (BSL license) | No |
Competitor pricing verified July 2026 from AWS, HashiCorp, and Doppler public pricing pages. HashiCorp discontinued HCP Vault Secrets (its per-secret SaaS) in 2025; remaining customers must migrate by July 1, 2026.
Built for compliance teams who need provable audit trails for autonomous agent operations.
Authenticated encryption. Unique salt + IV per secret.
Key derivation prevents brute force on master key.
Every agent action logged. Export CSV/JSON. EU AI Act ready.
Read/write/admin per key. Project-scoped. IP restrictions.
Cross-agent tokens auto-expire in 5 minutes. Single-use.
Every request authenticated. No implicit trust. Rate limited.
Every plan starts with a 7-day free trial — no charge until it ends. Included secrets plus low overage, unlimited agents, no per-seat fees. Cancel anytime.
For solo builders and agents. 25 secrets included, then $0.30/secret/mo.
For growing teams. 100 secrets included, then $0.20/secret/mo.
For high-volume fleets. 500 secrets included, then $0.12/secret/mo.
sc signup gives you a live vault instantly — a 48-hour activation window to store, retrieve and rotate secrets before the $0 card check starts your 7-day free trial. Need volume, SSO, or on-premise? Enterprise has custom pricing, unlimited everything, and a dedicated SLA — start with the quickstart and upgrade from your vault.
Stop passing keys in plain text. AES-256-GCM encryption. 7-day free trial, then from $9/mo. One CLI command.