# Introduction

**seekrit** is an end-to-end encrypted, multi-tenant secrets manager built on Cloudflare
Workers. It stores your API keys, database URLs, and other secrets, and hands them to your
applications — in local development, Docker builds, CI, Kubernetes, and AI-agent sandboxes —
without the server ever seeing a plaintext value.

## How it works, in three lines

1. **You encrypt.** Secrets are encrypted in your browser or CLI, with a key that only ever exists
   on your side. The server receives ciphertext.
2. **seekrit stores and distributes.** The API — running on Cloudflare's global edge — keeps the
   ciphertext and hands each authorized person, machine, or agent a copy of the environment's key
   wrapped just for them.
3. **Your runtime decrypts.** The CLI, a service token, or an AI agent unwraps that key locally and
   injects the plaintext straight into your process — never back to the server.

The result: one place to manage every secret, injected with one command everywhere your code runs,
that the backend is cryptographically unable to read.

> **Note:** **Are you (or is your) AI agent building with seekrit?** seekrit has a hosted [MCP server](/docs/mcp) an agent can self-register with and connect to in one request — no human, no install. Start with the [MCP server page](/docs/mcp) or the deeper [AI agents guide](/docs/guides/ai-agents), or point any agent at the machine-readable docs: [`/llms.txt`](/llms.txt) (index), [`/llms-full.txt`](/llms-full.txt) (everything in one file), or any page's URL with a `.md` suffix.

## Zero-knowledge by design

The defining property of seekrit is that **encryption keys are generated and used entirely on
the client**. When you add a secret in the web dashboard or CLI, it is encrypted in your browser
or on your machine before it is uploaded. The API — a Cloudflare Worker backed by managed
Postgres — only ever stores ciphertext. A full database dump reveals metadata (names, versions, timestamps) but no
secret values.

This is achieved with **envelope encryption**:

- Each **environment** has its own AES-256 data key (DEK).
- Secrets are encrypted with that DEK.
- The DEK is **wrapped** (encrypted) individually to each person or service token that should
  have access, using their public key.
- A user's private key is itself encrypted with a passphrase-derived key, so any device can
  fetch it and unlock it locally — the passphrase never leaves the client.

See [Encryption model](/docs/concepts/encryption) for the full picture.

## The pieces

seekrit has three parts:

- **Web dashboard** — create orgs, applications, and environments, and manage secrets with
  client-side encryption. Sign in with Google, GitHub, or an email and password (via Stytch).
- **CLI** (`seekrit`) — link a project directory to an environment and inject decrypted secrets
  into any command, or export them as `dotenv`/`json`/`shell`.
- **API** — a Hono Worker on Cloudflare with Postgres (via Hyperdrive) and KV, exposing an
  org-scoped REST API and an append-only audit trail.

## Built to scale, everywhere

Because the server only ever holds ciphertext, it can be cached anywhere without becoming a
liability. seekrit runs on Cloudflare's global edge, caches encrypted secrets close to your
workloads (keyed per caller, so tenants never share an entry), and serves the resolve hot path — every container, CI
job, and agent fetching its secrets on boot — from one org's laptop up to tens of thousands of reads
a day, with no infrastructure of your own. See [Scale & the edge](/docs/concepts/scale).

## Where to go next