Your agent asks for the key. You approve it with Face ID.
billing-agent is asking for Stripe test key
9:41left to decide
Sync prices to Stripe
You are approving this secret, not a command.
passkeyvault.ai keeps API keys and other secrets encrypted with your passkey. When a coding agent connected to Raq.com needs one, it asks by name, you approve on your phone, and the value is sealed so only that agent can open it.
Free with a Raq.com account.
The agent asks by name
An agent connected over MCP can list the names in your vault, never the values. It requests one, says why, and sends a public key made for this one request.
You approve it on your phone
Your phone shows which agent is asking, for which secret and why. Face ID or a fingerprint says yes. You have 10 minutes, then the request expires.
billing-agent is asking for Stripe test key
9:41left to decide
Sync prices to Stripe
You are approving this secret, not a command.
Your phone seals the value
Your passkey opens the vault on your device. The browser decrypts that one secret and seals it to the agent's public key. All Raq.com ever carries is the sealed copy.
It is released once
The agent collects the sealed copy one time, then Raq.com clears it. A second attempt gets nothing. A copy that isn't collected within 10 minutes is destroyed.
Sealed copy
One command gets the value
In Nature Work, the local agent opens the sealed copy in memory and passes the value to one command as an environment variable. It strips the value from the output before your coding agent reads it.
Then it is gone
The local agent discards the value when the command ends unless the agent passes --cache-session. Your coding agent saw the command and a scrubbed result. There is no key in the chat and no key in a .env file.
- Not in the chat
- Not in a .env file
- Raq.com has cleared its sealed copy
Who can see what
Raq.com stores ciphertext and carries sealed copies it can't open. The marked cells are the only places the plain value exists.
| Who | Secret names | Encrypted value | Sealed copy | Plain value |
|---|---|---|---|---|
| Your browser | Yes | Yes | Creates it | While you approve or edit |
| Raq.com | Stores them | Stores it | Carries it once, can't open it | No |
| Coding agent in Nature Work | Yes | No | Passes it on, can't open it | No, it reads scrubbed output |
| Nature Work's local agent | Only for a session copy | No | Opens it | In memory, for one command or one session |
| The command it runs | No | No | No | Yes, as an environment variable |
| Another agent over MCP | Yes | No | Opens it itself | Yes, it passes through that agent |
Deny with a reason
The agent gets the refusal, and sees your reason if you add one.
Freeze a secret or the vault
Every release is refused, including approvals that have not been collected yet.
More than one passkey
Register passkeys on several devices, and keep the recovery code shown once at setup.
Every change needs a passkey
Saving, editing and releasing a secret each ask for one, even when you are already signed in.
Where the protection stops
A vault narrows who can get a secret and when. It can't make the agent's command trustworthy.
- The agent chooses the commandYou approve a request for one named secret. The agent chooses the command that uses it, and that command gets the real value, so one written to send the key elsewhere can do that.
- Output scrubbing stops accidentsIt replaces the value and its base64, hex, URL-encoded and JSON forms with a marker. It won't stop a command set on leaking the key.
- Encryption runs in JavaScript served by Raq.comIf Raq.com itself were compromised, altered code could read a secret the next time you open the vault.
- A session copy outlives a freezeIn session mode the local agent keeps the value in memory until the session closes, the agent restarts or 24 hours pass. Freezing the vault can't clear a copy that has already been released.
- No key, no way backIf you lose every passkey and the recovery code, the vault can't be opened again. Raq.com holds no key that could reset it.
Built for coding agents
Claude Code and Codex in Nature Work get a key without ever seeing it. Any other agent connected to Raq.com can ask too.
Nature Work on your Mac
Its local agent makes a key pair for each request, keeps the private key in memory, opens the approved value, passes it to one command as an environment variable and strips it from the output. Your coding agent sees the command and its scrubbed result, never the key.
Any agent connected to Raq.com
There are three tools on the Raq.com MCP server: list the secret names, request one, and check the decision. Outside Nature Work, the agent makes its own key pair and opens the sealed value, so the value passes through that agent. Use Nature Work when it has to stay out of the chat.
How often you approve
Choose this per vault. A request keeps the setting that was on when it arrived, so switching to a session later doesn't widen it.
Every command
The default. The agent is told to use each approval for one command, and the local agent discards the value when the command ends unless the agent passes --cache-session.
Current session
One approval lets the same Nature Work session reuse that secret. It clears when the session closes, the local agent restarts, or after 24 hours.
Limits and settings
The numbers the vault enforces on every request, whichever agent sends it.
- Time to approve a request
- 10 minutes, then it expires
- Time to collect an approved value
- 10 minutes, then it is destroyed
- Releases per approval
- One
- Pending requests at once
- Up to 5 per vault
- New requests
- Up to 10 a minute
- Agent access
- Every command by default, or the current Nature Work session for up to 24 hours
- Passkeys
- Synced passkeys with the WebAuthn PRF extension, such as iCloud Keychain or Google Password Manager. Register more than one.
- Recovery
- One recovery code, shown once when you create the vault
- Encryption
- libsodium in your browser: XSalsa20-Poly1305 for stored values, a sealed box to the agent's X25519 key for releases
Questions
Can Raq.com read my secrets?
Not from what it stores. Your browser encrypts each value before it is saved, and the key that decrypts it is opened on your device, with your passkey or your recovery code. Raq.com keeps the encrypted value, its name and when it was last used. The plain value exists in your browser while you approve and in the command that receives it.
Can an agent see all my secrets?
It can see the names, so it knows what to ask for, but not the values. Each value needs its own request and your approval, and one approval releases it once.
Can an agent add or change a secret?
No. Secrets are added and edited in your browser, and every change asks for your passkey.
Which devices work?
You need a synced passkey that supports the WebAuthn PRF extension, such as one saved in iCloud Keychain or Google Password Manager. You approve with Face ID, Touch ID or a fingerprint, depending on the device.
What if I lose my phone?
Approve from another device that holds one of your vault's passkeys, or use the recovery code to create a replacement passkey and then remove the old one. Your saved secrets stay as they are.
Do I need Nature Work?
To keep the value out of your agent's chat, yes. Nature Work's local agent holds the private key, runs the command with the value and strips it from the output. Other agents connected to Raq.com can request a secret too, but they have to open the sealed value themselves, so the value passes through that agent.
Why not keep API keys in a .env file?
A .env file is plain text. Any agent session, script or package that can read the folder can read the keys, and they stay there until you delete them. Here each value stays encrypted until you approve one request for it.
What does it cost?
Nothing. It is free with a Raq.com account, with no charge per secret or per release.
Guides
- API keys out of .env files Why any agent in your project can read a .env file, and how to move the keys into the vault.
- API keys for Claude Code and Codex The request, your approval and the protected command, step by step, with what each side sees.
- Secrets over MCP The three MCP tools, the sealed exchange and what changes when the agent opens the value itself.
Set up your vault
Create a Raq.com account, register a passkey and save the recovery code before adding your first secret. It's free, with no charge per secret or per release.
- Store API keys, tokens and other secrets
- Approve or deny each agent request
- Register passkeys on more than one device
- Freeze one secret or the whole vault
- Add it to your phone's home screen