The vault where coding agents encrypt, rotate, and share secrets autonomously — solo, as a team, or across companies. One API key.
Your agents handle the entire secret lifecycle. You monitor and approve.
"Your agent encrypts it, retrieves it, versions it."
// Agent self-signup (zero friction)
POST /api/signup {"tenantId":"my-app"}
// → {"apiKey":"sc_free_my_app_..."}
// Store a secret (AES-256-GCM encrypted)
POST /api/v1/secrets
{"name":"DB_PASSWORD","value":"s3cur3!"}
// → encrypted, versioned, audit-logged
"Set a schedule. Agent rotates. Webhook fires. CI/CD picks up."
// Set 30-day rotation policy
POST /api/v1/rotation
{"secretId":"sec-abc","schedule":"30d",
"alertEmail":"ops@co.dev"}
// Day 30: auto-rotated, new version
// → webhook fires → CI/CD deploys
"Agent A creates claim token. Agent B claims. Auto-revoked."
// Agent A: create claim token
POST /api/v1/claim-tokens
{"secretValue":"sk_live_xxx",
"targetTenantId":"partner-app",
"contractId":"ctr_abc..."}
// → {"accessToken":"ctk_..."}
// Agent B: claim → auto-stored in vault
POST /api/v1/claim-tokens/ctk_.../claim
// → {"secretId":"sec-xyz"} // done
Solo, team, and cross-company — all agent-native.
Self-signup in <1s. Store, retrieve, rotate, share — all via API. Zero-friction. No dashboard required.
Project scoping, RBAC API keys, webhooks, audit trail. Each agent gets its own key with granular permissions.
Agents share secrets across companies via Buggazi contracts and claim tokens. Encrypted in transit and at rest.
Works with every AI coding agent. Drop in, encrypt, done.
# Agent self-signup — zero friction, instant API key
curl -X POST https://secretcarousel.com/api/signup \
-H "Content-Type: application/json" \
-d '{"tenantId": "my-project"}'
# Response:
# {"apiKey": "sc_free_my_project_a1b2c3...",
# "tenantId": "my-project", "plan": "free"}
# Store a secret — AES-256-GCM encrypted at rest
curl -X POST https://secretcarousel.com/api/v1/secrets \
-H "X-API-Key: sc_free_my_project_a1b2c3..." \
-H "Content-Type: application/json" \
-d '{"name": "DATABASE_URL",
"value": "postgres://user:pass@host/db",
"secretType": "database-credentials"}'
# Encrypted, versioned, audit-logged. Done.
# Retrieve — decrypted on-demand, access logged
curl https://secretcarousel.com/api/v1/secrets/sec-abc123 \
-H "X-API-Key: sc_free_my_project_a1b2c3..."
# {"name": "DATABASE_URL",
# "value": "postgres://user:pass@host/db",
# "version": 1, "accessCount": 1}
# Set 30-day rotation — fires webhook on rotate
curl -X POST https://secretcarousel.com/api/v1/rotation \
-H "X-API-Key: sc_free_my_project_a1b2c3..." \
-H "Content-Type: application/json" \
-d '{"secretId": "sec-abc123",
"schedule": "0 0 */30 * *",
"alertDaysBefore": 7,
"alertEmail": "ops@myproject.dev"}'
Works with Claude Code, Cursor, Cline, Windsurf, Aider, and any HTTP-capable agent.
Other vaults charge per human seat and treat agents as an afterthought. SecretCarousel charges per agent seat and treats humans as monitors.
| Capability | SecretCarousel | AWS Secrets Manager | HashiCorp Vault | Doppler |
|---|---|---|---|---|
| Agent Self-Signup | POST /api/signup | No (IAM console) | No (admin config) | No (dashboard) |
| Per-Agent Pricing | From $9.80/seat | $0.40/secret + API calls | $0.50/secret (HCP) | $21/human/mo |
| Cross-Agent Key Exchange | Claim tokens | No | No | No |
| E2E Encryption | AES-256-GCM | AWS KMS | Transit engine | No |
| Immutable Audit Trail | Every op logged | CloudTrail (separate) | Audit device (config) | Basic logs |
| Setup Time | <1 second | Hours (IAM + KMS) | Days (cluster) | Minutes (dashboard) |
| Self-Hostable | Docker | No | Yes (BSL license) | No |
Built for compliance teams who need provable audit trails for autonomous agent operations.
Authenticated encryption. Unique salt + IV per secret.
Key derivation prevents brute force on master key.
Every agent action logged. Export CSV/JSON. EU AI Act ready.
Read/write/admin per key. Project-scoped. IP restrictions.
Cross-agent tokens auto-expire in 5 minutes. Single-use.
Every request authenticated. No implicit trust. Rate limited.
AWS charges per secret. Vault charges per secret. We charge per agent. Start free.
For solo agents getting started.
$9.80 per agent seat. For agent teams.
$7.45 per agent seat. For agent fleets.
For large agent fleets.
Secret vault for coding agents. AES-256-GCM encryption. Per-agent-seat pricing. One API key.