# SecretCarousel API Reference (llms.txt) # The agent-first secret vault. AES-256-GCM encryption. 7-day free trial, then from $9/mo. # https://secretcarousel.com # # PROBLEM: Agents pass API keys, DB passwords, and tokens in plain text. # .env files in Slack. Credentials hardcoded in code. One leak exposes everything. # SOLUTION: Store in SecretCarousel. Encrypted. Audited. Rotated. Retrieved on demand. ## CLI (Recommended for Agents) npm install -g secretcarousel # or use npx sc signup my-project --local # instant key, saved to .sc/config.json sc secret "NAME" "VALUE" # store (AES-256-GCM encrypted) sc secret show # retrieve (decrypted) sc secrets # list all sc rotate # rotate now sc share --hours 1 # time-limited share link sc env pull --env production # export as .env sc audit # query audit trail sc --json # add to any command for JSON output ## Authentication CLI: key loaded from .sc/config.json or SC_API_KEY env var (auto) API: X-API-Key header. Format: sc_trial__ or sc__ ## Agent Self-Signup CLI: npx secretcarousel signup my-project --local API: POST /api/signup {"tenantId":"my-project"} Returns: {apiKey, tenantId, plan, limits, quickstart} No password. No verification. Instant API key. ## Secrets (AES-256-GCM encrypted at rest) POST /api/v1/secrets Create: {name, value, secretType, tags[], projectId} GET /api/v1/secrets List (metadata only, no values). Filter: ?secretType=&category=&environment= GET /api/v1/secrets/:id Get with decrypted value. Access logged. PUT /api/v1/secrets/:id Update (creates new version). {value, description, tags[]} DELETE /api/v1/secrets/:id Delete. Audit logged. GET /api/v1/secrets/:id/versions Version history. secretType: database-credentials | api-key | certificate | oauth-token | encryption-key | configuration | custom ## Secret Sharing (Pro plan) POST /api/v1/shares Create share: {secretId, expirationHours, maxUses, password?, allowedIPs[]} POST /api/v1/shares/access/:token Access shared secret (public, no auth needed). {password?} GET /api/v1/shares List active shares. DELETE /api/v1/shares/:id Revoke share. ## Secret Rotation (Pro plan) GET /api/v1/rotation List rotation policies. POST /api/v1/rotation Create: {secretId, schedule (cron), alertDaysBefore, alertEmail} PUT /api/v1/rotation/:id Update policy. DELETE /api/v1/rotation/:id Remove policy. POST /api/v1/rotation/:id/rotate-now Rotate immediately. ## Claim Tokens (Pro plan - cross-agent key exchange via Buggazi contracts) POST /api/v1/claim-tokens Create: {secretValue, secretName, targetTenantId, contractId, expiresInMinutes?} POST /api/v1/claim-tokens/:token/claim Claim and auto-store in vault. Returns {secretId}. GET /api/v1/claim-tokens List (created by or targeted at your tenant). DELETE /api/v1/claim-tokens/:id Revoke claim token. ## Projects POST /api/v1/projects Create: {name, description, tags[]} GET /api/v1/projects List with secret counts. GET /api/v1/projects/:id Project details. PUT /api/v1/projects/:id Update. DELETE /api/v1/projects/:id Delete (must remove secrets first). ## API Keys POST /api/v1/api-keys Create: {name, permissions, projectScope[], expiresAt} GET /api/v1/api-keys List (never shows full key). PUT /api/v1/api-keys/:id Update permissions/scope. DELETE /api/v1/api-keys/:id Revoke. POST /api/v1/api-keys/:id/regenerate New key, old invalidated. permissions: read | write | admin ## Audit Trail GET /api/v1/audit Query: ?action=&resourceType=&startDate=&endDate=&limit=&offset= GET /api/v1/audit/export Export: ?format=csv|json ## Backup & Recovery POST /api/v1/backup Create encrypted backup. GET /api/v1/backup List backups. POST /api/v1/backup/:id/restore Restore from backup. DELETE /api/v1/backup/:id Delete backup. ## Webhooks POST /api/v1/webhooks Create: {url, events[], secret} GET /api/v1/webhooks List. PUT /api/v1/webhooks/:id Update. DELETE /api/v1/webhooks/:id Remove. POST /api/v1/webhooks/:id/test Send test payload. events: secret.created | secret.updated | secret.deleted | secret.rotated | secret.shared | apikey.created | apikey.revoked | backup.created ## Plan & Usage GET /api/v1/plan Current plan, usage, limits. GET /api/v1/plan/usage Detailed usage breakdown. GET /api/signup/limits Public: plan comparison. GET /api/quickstart Machine-readable getting started. ## Feedback (available on EVERY plan, incl. trial-pending) POST /api/v1/feedback File a bug/feature: {type: bug|feature, title, description?, severity?, priority?} GET /api/v1/feedback List feedback you filed: ?type=bug|feature&limit= GET /api/v1/feedback/:id/comments Read the thread on a filed item. POST /api/v1/feedback/:id/comments Add a follow-up: {message} CLI: sc feedback "" [-d "..."] [-s P2] | sc feedback feature "<title>" [-p P2] | sc feedback list | sc feedback show <ID> | sc feedback comment <ID> "msg" Reports land on the SecretCarousel team board, attributed to your tenant. Hit a bug on trial? Report it — no upgrade needed. ## Pricing Every paid plan starts with a 7-day free trial, then bills monthly. Cancel anytime. Starter: $9/mo — 25 secrets included, then $0.30/secret/mo. 100K API calls/mo. Rotation, sharing, claim tokens, webhooks. Pro: $29/mo — 100 secrets included, then $0.20/secret/mo. 500K API calls/mo. Everything in Starter + RBAC, encrypted backups, IP whitelist, priority support. Scale: $99/mo — 500 secrets included, then $0.12/secret/mo. 2.5M API calls/mo. Everything in Pro + SSO/SAML, Kubernetes & Terraform providers. Enterprise: custom — unlimited everything, on-premise, dedicated SLA. No free plan. Agent self-signup (sc signup / remote MCP) provisions a trial-pending vault: 48-hour activation window with store/retrieve/rotate (25 secrets max), then the key locks unless the 7-day free trial is started ($0 card check via emailed link). Vault and secrets are preserved; activating later revives the key. ## SDKs npm install secretcarousel CLI (npx secretcarousel signup --tenant my-project) npm install secretcarousel-sdk Node.js pip install secretcarousel Python go get github.com/jyswee/secretcarousel-go Go Any language works via the REST API + remote MCP (Ruby/Rust/PHP/C#/Dart SDKs on the roadmap). ## Key Patterns - Secret IDs: secret-uuid (auto-generated) - API Key prefix: sc_trial_ (agent self-signup, trial-pending) or sc_ (paid) - Encryption: AES-256-GCM, PBKDF2 100K iterations, unique salt+IV per secret - Versioning: auto-version on every PUT - Audit: every operation logged (immutable) - Claim tokens: ctk_ prefix, single-use, 5min default TTL ## Documentation Quickstart: https://secretcarousel.com/docs/quickstart.html Claude Web: https://secretcarousel.com/docs/quickstart/claude-web.html Claude Code: https://secretcarousel.com/docs/quickstart/claude-code.html API Reference: https://secretcarousel.com/api npm: https://www.npmjs.com/package/secretcarousel