SecretCarousel + Claude Code

Install and signup

# One command. Instant API key. Saved to project.
npx secretcarousel signup my-project --local

# Output:
# Tenant "my-project" created!
# API Key: sc_trial_my_project_a1b2c3...
# Saved: .sc/config.json (local)

Add to your CLAUDE.md

Paste this into your project's CLAUDE.md. Claude Code reads it at session start.

# SecretCarousel Integration

This project uses SecretCarousel for encrypted secret management.
CLI installed: npx secretcarousel (or sc if global). Key in .sc/config.json.

## Storing secrets
sc secret "NAME" "VALUE" [-t database-credentials|api-key|certificate|custom]

## Retrieving secrets
sc secret show <secretId>

## Listing secrets
sc secrets [--type X] [--env X]

## Updating secrets
sc secret update <secretId> --value "new-value"

## Deleting secrets
sc secret delete <secretId>

## Rotating (Pro plan)
sc rotate <secretId>
sc rotate set <secretId> --schedule "30d"

## Sharing (Pro plan)
sc share <secretId> --hours 1 --views 1

## Environment export
sc env pull --env production > .env

## Audit trail
sc audit [--action secret.read] [--limit 20]
sc audit export --format csv

## Key patterns
- Use sc --json for structured JSON output
- Secret IDs: secret-uuid (auto-generated)
- AES-256-GCM encrypted at rest
- Every access audit-logged
- Config: .sc/config.json (add .sc/ to .gitignore)

Use it

Claude Code now has full SecretCarousel capabilities. Try:

# Store a database credential
"Store our production database URL in SecretCarousel"
# Agent runs: sc secret "DATABASE_URL" "postgres://..." -t database-credentials

# Retrieve for deployment
"Get the DATABASE_URL secret"
# Agent runs: sc secret show sec-abc123

# Export for docker-compose
"Export production secrets as .env"
# Agent runs: sc env pull --env production > .env

# Rotate after incident
"Rotate the compromised API key"
# Agent runs: sc rotate sec-abc123