Unseenkey
Let AI agents, scripts and the people you hire use your API keys — without ever seeing them.
Unseenkey keeps your keys in an encrypted vault on your machine and hands out handles instead. A handle only works through the local broker, within a policy you set, and every call is logged.
A leaked handle costs you nothing. A leaked key costs you until you notice.
Two minutes with Claude Code
Add the key once. From then on every tool gets a handle, and the broker does the rest.
Works the same for OpenAI, Stripe, AWS, GitHub, Google, Slack and twelve more providers, plus any other host. --shell powershell|cmd|dotenv prints the variables for your shell or .env. The daemon starts itself, listens on loopback only, and locks when you walk away.
How it works
The key never leaves the vault except inside a request the policy allowed. Watch an allowed call go through, and a forbidden one stop at the broker.
Three ways a key leaks. One fix.
Every SDK, .env file and AI agent asks for the raw key. Once it exists in plaintext it gets pasted, committed, logged, or handed to someone.
Your AI agent
Claude Code, Cursor, Windsurf and MCP tools call APIs through the broker. The key is never in the context window, never in a transcript, never in the agent's memory. usk mcp install claude-code.
Your own scripts and repos
usk guard fix .env moves real keys into the vault and rewrites the file with handles. Commit it, screenshot it, paste it: nothing happens. Caps and canaries catch what slips through.
The developer you hire
Grant a freelancer or agency the use of a key with a policy, an expiry and a signed log, through a broker they don't control. Revoke in one click; they can prove they never held it.
What a handle can do
Each handle carries its own rules, explained in plain English, enforced before anything leaves your machine.
Policy per handle
Presets per provider: stripe:payments takes payments and refuses refunds and payouts. Paths, methods, time windows, expiry, approvals.
Hard caps
--cap 500/day: the 501st request is refused before it leaves the machine. A stolen handle cannot run up a bill.
Canaries
--canary makes a handle that never works. Plant it in .env.example; any use means someone has your files, and the vault locks.
Incident responses
A burst of refused requests throttles, pauses, asks you, or locks the vault. Your choice per handle; one click to resume.
Live approvals
Sensitive calls wait for you: allow once, allow always for this rule, or deny. Desktop notifications on Windows, macOS and Linux.
Camouflage handles
Handles shaped like the provider's own keys for SDKs that validate formats. Every format carries the usk marker.
AWS and OAuth2
boto3, the AWS CLI and the JS SDK sign with a placeholder; the broker re-signs with the real key. Refresh tokens stay in the vault.
Tamper-evident log
Every call, allowed or refused, in a hash-chained audit log, written before the first byte goes out. usk log verify.
Desktop app
Secrets, handles, approvals and activity in one window. Windows Hello unlock, lock on sleep and screen lock, signed auto-updates.
Which one would leak?
Paste a key or a handle. This runs in your browser; nothing is sent anywhere, and this page has no analytics. Still: don't paste your real keys into web pages, use the samples.
What a policy says
Every preset renders to plain English, exactly what usk policy explain prints. Pick a provider and a policy.
Install
Signed builds for every platform. No account, no telemetry, nothing leaves your machine.
# Windows scoop bucket add unseenkey https://github.com/Bhagyesh97/scoop-unseenkey scoop install usk # macOS and Linux brew install Bhagyesh97/unseenkey/usk # from source (Rust 1.85+) cargo install --locked --git https://github.com/Bhagyesh97/unseenkey usk
Desktop installers for Windows, macOS and Linux, and CLI archives for every platform, are on the releases page. Every archive has a Sigstore signature, every installer a minisign signature, and each release ships an SBOM. The installers are not yet code-signed, so Windows SmartScreen and macOS Gatekeeper warn on first launch.
Security
- Vault: Argon2id and XChaCha20-Poly1305, keys locked in memory, a 24-word recovery phrase, optional Windows Hello.
- Fail closed: each secret is locked to its provider's hosts; unmatched requests, browser-origin requests and anything the broker cannot classify are refused.
- Scrubbing: the real key and its encodings are removed from responses, logs and error messages.
- Open: Apache-2.0, a published threat model that also says what it does not protect against, and a disclosure policy.
Alpha software, not yet externally audited. Use it with keys you can rotate. A process with code execution on your machine can still use an unlocked vault within policy; for a hostile agent you also want an OS sandbox.
Hiring a developer? Never hand over your keys.
Delegation is the next thing we build: a client grants a developer or agency the use of a Stripe, AWS or OpenAI key with a policy, an expiry and a signed log, through a broker the developer does not control. If you have handed a key to a contractor, or been handed one, we would like to talk to you before we build it.