EnvVault
A secrets vault built to hand an AI agent a short-lived, scoped token that is safe to paste into a chat.
The problem
Handing an AI agent your real API key is how keys leak.
The moment you paste a live key into a chat, it sits in that log for good, with full access to every app it can reach and no clean way to pull it back. Managing it by hand is worse: keys sprawl across .env files, shared docs, and screenshots, and nobody is sure which ones are still live. Most teams learn a key leaked only after someone uses it.
What it does
safe to hand an agentEvery secret is sealed before it touches disk.
Values are encrypted with AES-256-GCM and organized by application and environment, so OPENAI_API_KEY in prod is its own record. Nothing is stored in the clear.
A token that expires, limited to one app.
Mint a session token that lives from 1 hour to 7 days, restricted to read or write and to named apps like claude. If it leaks it dies on its own, and you can revoke it in one click.
One link configures an agent.
The dashboard mints a 30-minute token inside a short-lived setup URL that serves a ready-made API guide. Drop the link into a fresh chat: the agent reads the guide, gets its scoped token, and never sees your master key.
Every user gets an isolated vault.
Self-service registration with admin approval, roles of read / write / admin, and email 2FA on sessions. Data is fully isolated between users, with SSO through Authentik.
One link in, a configured agent out
How it's built
Four dependencies, no build step, and a database that fits in a file.
EnvVault is Flask and Jinja with HTMX for the interactive parts, so there is no bundler and nothing to compile. Data lives in one SQLite file in WAL mode on a Fly volume; encryption is a thin AES-256-GCM layer over the values, keyed by a master key held only in the environment. The whole runtime is four Python packages, covered by 164 tests. We run it as Wolf Works' own secrets backend.
This is what six weeks looks like
We built EnvVault for ourselves. We can build yours.
Every product in our labs was designed and shipped by the same two-person team that would build your MVP. If you have an idea worth building, that's the whole pitch.
Start a build →