Introduction
seekrit is an end-to-end encrypted, multi-tenant secrets manager built on Cloudflare Workers. It stores your API keys, database URLs, and other secrets, and hands them to your applications — in local development, Docker builds, CI, Kubernetes, and AI-agent sandboxes — without the server ever seeing a plaintext value.
How it works, in three lines
- You encrypt. Secrets are encrypted in your browser or CLI, with a key that only ever exists on your side. The server receives ciphertext.
- seekrit stores and distributes. The API — running on Cloudflare's global edge — keeps the ciphertext and hands each authorized person, machine, or agent a copy of the environment's key wrapped just for them.
- Your runtime decrypts. The CLI, a service token, or an AI agent unwraps that key locally and injects the plaintext straight into your process — never back to the server.
The result: one place to manage every secret, injected with one command everywhere your code runs, that the backend is cryptographically unable to read.
Are you (or is your) AI agent building with seekrit? seekrit has a hosted
MCP server an agent can self-register with and connect to in one request — no
human, no install. Start with the MCP server page or the deeper
AI agents guide, or point any agent at the machine-readable docs:
/llms.txt (index), /llms-full.txt (everything in one file),
or any page's URL with a .md suffix.
Zero-knowledge by design
The defining property of seekrit is that encryption keys are generated and used entirely on the client. When you add a secret in the web dashboard or CLI, it is encrypted in your browser or on your machine before it is uploaded. The API — a Cloudflare Worker backed by managed Postgres — only ever stores ciphertext. A full database dump reveals metadata (names, versions, timestamps) but no secret values.
This is achieved with envelope encryption:
- Each environment has its own AES-256 data key (DEK).
- Secrets are encrypted with that DEK.
- The DEK is wrapped (encrypted) individually to each person or service token that should have access, using their public key.
- A user's private key is itself encrypted with a passphrase-derived key, so any device can fetch it and unlock it locally — the passphrase never leaves the client.
See Encryption model for the full picture.
The pieces
seekrit has three parts:
- Web dashboard — create orgs, applications, and environments, and manage secrets with client-side encryption. Sign in with Google, GitHub, or an email and password (via Stytch).
- CLI (
seekrit) — link a project directory to an environment and inject decrypted secrets into any command, or export them asdotenv/json/shell. - API — a Hono Worker on Cloudflare with Postgres (via Hyperdrive) and KV, exposing an org-scoped REST API and an append-only audit trail.
Built to scale, everywhere
Because the server only ever holds ciphertext, it can be cached anywhere without becoming a liability. seekrit runs on Cloudflare's global edge, caches encrypted secrets close to your workloads (keyed per caller, so tenants never share an entry), and serves the resolve hot path — every container, CI job, and agent fetching its secrets on boot — from one org's laptop up to tens of thousands of reads a day, with no infrastructure of your own. See Scale & the edge.