\n
\n ββββββββββββ ββββββ ββββββ βββββββ ββββββββββ βββ\n βββββββββββββ ββββββ ββββββ ββββββββββββββββββββ ββββ\n ββββββ ββββββ ββββββ ββββββ βββ ββββββ βββββββ\n ββββββ βββββββββββββ ββββββ βββ ββββββ βββββββ\n βββββββββββ βββββββββββββββββββββββββββββββββββββββββββ βββ\n βββββββββββ βββββ βββββββ ββββββββ βββββββ ββββββββββ βββ\n\n\n\n
\n π Secure Credential Vault for AI Agents\n
\n\n\n npm install -g envlock\n
\n Website β’\n Quick Start β’\n For AI Agents β’\n Web UI β’\n Templates β’\n Commands β’\n Security β’\n Contributing\n
\n\n---\n\n\n
\n .-\"\"\"-.\n / \\\n | .--. |\n | | | |\n | | π | |\n | | | |\n | '--' |\n \\ /\n '-..-'\n\n\n\n> **Stop pasting API keys into chat. Store them securely. Let your AI agent access them safely.**\n\n---\n\n## π€ The Problem\n\nEvery day, millions of users paste API keys, tokens, passwords, and credentials directly into AI chat interfaces. This is **dangerous**:\n\n| Risk | What Happens |\n|------|-------------|\n| π **Conversation History** | Keys get stored on AI provider servers β forever |\n| π **Data Breaches** | If the provider gets hacked, your keys are exposed |\n| π£ **Prompt Injection** | Malicious prompts can trick the AI into leaking your keys |\n| π€ **Training Data** | Keys might end up in model training data |\n| π **Screen Sharing** | Anyone who sees the chat sees your secrets |\n| π **No Revocation** | You can't \"un-paste\" a key from chat history |\n\n## π‘ The Solution: Envlock\n\nEnvlock is a **secure local vault** that sits between users and AI agents. Instead of pasting keys into chat, users input them through a **secure web form**, and AI agents read them through a **safe API**.\n\n```\nβ OLD WAY:\nUser β [pastes key in chat] β AI Agent β External API\n β\n Key exposed in chat history, logs, training data\n\nβ ENVLOCK WAY:\nUser β [pastes key in web form] β Encrypted Vault β AI Agent β External API\n β β\n Never enters chat Encrypted at rest\n Localhost only Agent reads via API\n```\n\n---\n\n## β‘ Quick Start\n\n### Step 1: Install (AI Agent does this)\n\n```bash\nnpm install -g @adewale0o/envlock\n```\n\n### Step 2: Initialize (AI Agent does this)\n\n```bash\nenvlock init\n# You'll set a master password. This encrypts everything.\n```\n\n### Step 3: Start Web UI (AI Agent does this)\n\n**If agent and user are on the same computer:**\n```bash\nenvlock serve\n# β http://127.0.0.1:3847/?token=abc123...\n```\n\n**If agent is on a server and user is on a different device:**\n```bash\nenvlock serve --expose\n# β http://192.168.1.100:3847/?token=abc123...\n```\n\n### Step 4: User Opens Link (User does this)\n\nThe agent tells the user: *\"Open this link to add your API keys\"*\n\nThe user:\n1. Opens the URL in their browser\n2. Sees a clean form with service templates (OpenAI, Stripe, Discord, etc.)\n3. Picks the service they want\n4. Pastes their API key into the form\n5. Clicks \"Save Securely\"\n6. Done! Key is encrypted in the vault. Never touched chat.\n\n### Step 5: Agent Reads Keys (AI Agent does this)\n\n```bash\nenvlock get OPENAI_API_KEY\n# β sk-1234567890...\n```\n\n### The Complete Flow\n\n```\nβββββββββββββββ ββββββββββββββββ βββββββββββββββ\nβ User β β Envlock β β AI Agent β\nβ β β (Vault) β β β\nβ Opens link ββββββββββΆβ Web form β β β\nβ Picks svc β β AES-256 β β β\nβ Pastes key ββββββββββΆβ Encrypts β β β\nβ β β Stores β β β\nβ β β βββββββββββ Reads key β\nβ β β β β Calls API β\nβ β β β β Done β β\nβββββββββββββββ ββββββββββββββββ βββββββββββββββ\n\nKey NEVER enters chat. Key NEVER leaves localhost. Key is ALWAYS encrypted.\n```\n\n---\n\n## π€ For AI Agents\n\nEnvlock is designed **specifically for AI agents** to install and manage. Here's how different agents use it:\n\n### OpenClaw\n\n```bash\n# OpenClaw agent runs:\nnpm install -g envlock && envlock init\n\n# Agent starts web UI, gets URL\nenvlock serve\n# β \"Open http://127.0.0.1:3847/?token=xxx to add your keys\"\n\n# Agent tells user the URL\n# User opens link, adds keys\n# Agent reads keys via:\nenvlock get OPENAI_API_KEY --raw\n```\n\n### Claude Code\n\n```bash\n# Claude Code can install and use Envlock:\nnpm install -g envlock\n\n# Initialize vault\nenvlock init\n\n# Create slots for needed keys\nenvlock create ANTHROPIC_API_KEY -d \"Anthropic API key\" -t api_key\n\n# Start web UI for user input\nenvlock serve\n\n# Later, read keys programmatically\nenvlock api get ANTHROPIC_API_KEY --json\n```\n\n### Cursor / Windsurf / Any AI Agent\n\n```bash\n# Any AI agent can use the JSON API\nenvlock api list --json\nenvlock api get KEY_NAME --json\nenvlock api create NEW_KEY --json\nenvlock api set NEW_KEY --json\nenvlock api export --json\n```\n\n### Agent API Reference\n\nAll agent API calls return JSON and support `--json` flag:\n\n```bash\n# List all secrets\nenvlock api list --json\n# β {\"success\": true, \"slots\": [{\"name\": \"OPENAI_API_KEY\", \"type\": \"api_key\", ...}]}\n\n# Get a specific secret\nenvlock api get OPENAI_API_KEY --json\n# β {\"success\": true, \"slot\": \"OPENAI_API_KEY\", \"value\": \"sk-...\"}\n\n# Create a new slot\nenvlock api create NEW_KEY --json\n# β {\"success\": true, \"slot\": \"NEW_KEY\"}\n\n# Set a value\nenvlock api set NEW_KEY --json\n# β {\"success\": true, \"slot\": \"NEW_KEY\"}\n\n# Export all secrets as env vars\nenvlock api export --json\n# β {\"success\": true, \"secrets\": {\"KEY1\": \"val1\", \"KEY2\": \"val2\"}}\n\n# Check vault status\nenvlock api status --json\n# β {\"success\": true, \"initialized\": true, \"locked\": false, \"slots\": 5}\n```\n\n### Agent Permissions\n\nWhen registering agents, you can set granular permissions:\n\n```bash\n# Register with specific permissions\nenvlock api register --json\n# Permissions: read, list, write, create, delete, execute\n\n# Scoped access β agent only sees specific slots\nenvlock api register --json\n# allowedSlots: [\"OPENAI_API_KEY\", \"STRIPE_KEY\"]\n```\n\n---\n\n## π Web UI β The Core Feature\n\nThe web UI is **why Envlock exists** β instead of pasting API keys into chat (where they get logged, stored, and potentially leaked), users paste them into a **clean web form** that goes straight into an encrypted vault.\n\n```\nβ DON'T DO THIS:\nUser: \"here's my API key: sk-1234567890...\"\nβ Key is now in chat history, logs, training data\n\nβ DO THIS INSTEAD:\nAgent: \"Open http://127.0.0.1:3847/?token=xxx to add your keys\"\nUser: *opens link, picks OpenAI, pastes key in form*\nβ Key goes directly into encrypted vault. Never in chat.\n```\n\n---\n\n### Two Modes β Which One Do I Use?\n\n#### Mode 1: Localhost (Default)\n\n```bash\nenvlock serve\n```\n\n```\nYour Computer\nββββββββββββββββββββββββββββββββ\nβ AI Agent (OpenClaw, etc.) β\nβ β β\nβ Envlock Vault (encrypted) β\nβ β β\nβ Web UI at 127.0.0.1:3847 ββββ Only accessible from THIS machine\nββββββββββββββββββββββββββββββββ\n```\n\n**When to use:**\n- β AI agent runs on YOUR computer (Cursor, Claude Code desktop, OpenClaw local)\n- β You open the browser on the SAME machine\n- β Most secure β nothing leaves your computer\n\n**How it works:**\n1. Agent runs `envlock serve`\n2. Agent gives you the URL: `http://127.0.0.1:3847/?token=abc123`\n3. You open that URL in your browser ON THE SAME COMPUTER\n4. You see the form, pick a service, paste your key\n5. Key is encrypted and stored locally\n6. Agent reads it when needed\n\n**Who can access:** Only you, from the same machine. Nobody else can reach `127.0.0.1`.\n\n---\n\n#### Mode 2: Network Exposed (`--expose`)\n\n```bash\nenvlock serve --expose\n```\n\n```\nYour VPS/Server Your Laptop/Phone\nββββββββββββββββββββββββ ββββββββββββββββ\nβ AI Agent β β Browser β\nβ β β β β\nβ Envlock Vault ββββββββββββ You open β\nβ β β network β the URL β\nβ Web UI at β β β\nβ 0.0.0.0:3847 β ββββββββββββββββ\nββββββββββββββββββββββββ\n```\n\n**When to use:**\n- β AI agent runs on a VPS/cloud server (DigitalOcean, AWS, etc.)\n- β You want to add keys from your laptop or phone\n- β You're on the same WiFi/LAN network as the server\n\n**How it works:**\n1. Agent runs `envlock serve --expose` on the server\n2. Agent gives you the URL: `http://192.168.1.100:3847/?token=abc123`\n3. You open that URL from ANY device on the same network\n4. You see the form, pick a service, paste your key\n5. Key is encrypted and stored on the server\n6. Agent reads it when needed\n\n**Who can access:** Anyone on the same network who has the token URL. The token is required β without it, you just see a \"enter token\" page.\n\n---\n\n### Quick Decision Guide\n\n| Your Setup | Command | Why |\n|------------|---------|-----|\n| Agent on my laptop, I use my laptop | `envlock serve` | Same machine = localhost is enough |\n| Agent on a VPS, I use my laptop | `envlock serve --expose` | Different machines = need network access |\n| Agent on a VPS, I'm on the internet | `envlock serve --expose` + firewall/port forward | Need to open port on your VPS |\n| Just me, just testing | `envlock serve` | Simplest option |\n\n---\n\n### Security β Is This Safe?\n\n**Yes.** Here's why:\n\n| Layer | Protection |\n|-------|-----------|\n| π **Token auth** | URL contains a random 32-char token. No token = no access |\n| π **Localhost default** | Only exposed to the internet if YOU choose `--expose` |\n| π **Encrypted** | All secrets are AES-256 encrypted on disk |\n| π« **No chat** | Keys never enter conversation history |\n| π **Audit log** | Every access is logged with timestamp |\n| β° **One-time token** | Token changes each time you restart `envlock serve` |\n\n**Even with `--expose`:**\n- The server only listens on your local network (LAN), not the internet\n- A random token is required for every request\n- Without the token, you see nothing useful\n- The token changes every restart\n\n---\n\n### Web UI Features\n\n| Feature | Description |\n|---------|-------------|\n| π¨ **Clean Dark UI** | Purple-themed, minimal, not generic AI slop |\n| π **46 Templates** | Pick OpenAI, Stripe, Discord, AWS, etc. |\n| π **Bulk Add** | Paste multiple `NAME=value` pairs at once |\n| π₯ **Import .env** | Paste your existing `.env` file |\n| π **Encrypted** | All data encrypted immediately |\n| π **Token Protected** | URL contains one-time access token |\n\n### What Users See\n\n**Dashboard:**\n```\nββββββββββββββββββββββββββββββββββββββββββββββββ\nβ π Envlock 5 secrets [+ Add] β\nββββββββββββββββββββββββββββββββββββββββββββββββ€\nβ Your Secrets β\nβ βββββββββββ βββββββββββ βββββββββββ β\nβ β π β β π« β β π β β\nβ β OPENAI β β STRIPE β β DB_URL β β\nβ β β Set β β β Set β β β Set β β\nβ βββββββββββ βββββββββββ βββββββββββ β\nβ β\nβ Add by Service β\nβ π€ AI & Machine Learning β\nβ βββββββ βββββββ βββββββ βββββββ β\nβ βOpenAIβ βAnthroβ βGeminiβ β HF β β\nβ βββββββ βββββββ βββββββ βββββββ β\nβ π± Social Media β\nβ βββββββ βββββββ βββββββ βββββββ β\nβ βTwittrβ βDiscrdβ βTelegrβ βSlackβ β\nβ βββββββ βββββββ βββββββ βββββββ β\nββββββββββββββββββββββββββββββββββββββββββββββββ\n```\n\n**Add Secret Form (e.g., OpenAI):**\n```\nββββββββββββββββββββββββββββββββββββββββββββββββ\nβ β Back π€ OpenAI β\nββββββββββββββββββββββββββββββββββββββββββββββββ€\nβ β\nβ API Key * β\nβ ββββββββββββββββββββββββββββββββββββββββ β\nβ β sk-... ποΈ β β\nβ ββββββββββββββββββββββββββββββββββββββββ β\nβ β\nβ Organization ID β\nβ ββββββββββββββββββββββββββββββββββββββββ β\nβ β org-... β β\nβ ββββββββββββββββββββββββββββββββββββββββ β\nβ β\nβ ββββββββββββββββββββββββββββββββββββββββ β\nβ β π Save Securely β β\nβ ββββββββββββββββββββββββββββββββββββββββ β\nββββββββββββββββββββββββββββββββββββββββββββββββ\n```\n\n---\n\n## π¦ 46 Service Templates\n\nPre-built forms so users don't have to figure out field names. Agents can use templates programmatically:\n\n```bash\n# List all templates\nenvlock templates\n\n# List by category\nenvlock templates -c social\n\n# Use a template interactively\nenvlock from-template openai\n\n# Use via web UI\n# β http://127.0.0.1:PORT/add?template=openai&token=xxx\n```\n\n### π€ AI & Machine Learning (5)\n| ID | Service | Fields |\n|----|---------|--------|\n| `openai` | OpenAI | API Key, Org ID |\n| `anthropic` | Anthropic (Claude) | API Key |\n| `google-ai` | Google AI (Gemini) | API Key |\n| `huggingface` | Hugging Face | Access Token |\n| `replicate` | Replicate | API Token |\n\n### π± Social Media (11)\n| ID | Service | Fields |\n|----|---------|--------|\n| `twitter` | Twitter / X | API Key, API Secret, Access Token, Access Secret, Bearer Token |\n| `discord` | Discord | Bot Token, Client ID, Client Secret |\n| `telegram` | Telegram | Bot Token, Chat ID |\n| `slack` | Slack | Bot Token, App Token, Webhook URL |\n| `instagram` | Instagram | Username, Password, Access Token |\n| `facebook` | Facebook / Meta | Access Token, App ID, App Secret |\n| `linkedin` | LinkedIn | Access Token, Client ID, Client Secret |\n| `youtube` | YouTube / Google | API Key, Client ID, Client Secret, Refresh Token |\n| `tiktok` | TikTok | Access Token, Client Key, Client Secret |\n| `reddit` | Reddit | Client ID, Client Secret, Username, Password |\n| `pinterest` | Pinterest | Access Token, App ID |\n\n### π οΈ Developer Tools (1)\n| ID | Service | Fields |\n|----|---------|--------|\n| `github` | GitHub | Personal Access Token, Username |\n\n### βοΈ Cloud & Infrastructure (7)\n| ID | Service | Fields |\n|----|---------|--------|\n| `aws` | AWS | Access Key ID, Secret Access Key, Region, Session Token |\n| `gcp` | Google Cloud | Project ID, Service Account JSON |\n| `azure` | Azure | Client ID, Client Secret, Tenant ID, Subscription ID |\n| `vercel` | Vercel | API Token |\n| `netlify` | Netlify | Auth Token |\n| `digitalocean` | DigitalOcean | API Token |\n| `flyio` | Fly.io | API Token |\n\n### ποΈ Databases (6)\n| ID | Service | Fields |\n|----|---------|--------|\n| `postgres` | PostgreSQL | Connection URL, Host, Port, User, Password, Database |\n| `mysql` | MySQL | Connection URL, Host, User, Password, Database |\n| `mongodb` | MongoDB | Connection URI |\n| `redis` | Redis | Connection URL |\n| `firebase` | Firebase | API Key, Auth Domain, Project ID, Service Account |\n| `supabase` | Supabase | Project URL, Anon Key, Service Role Key |\n\n### π³ Payments (2)\n| ID | Service | Fields |\n|----|---------|--------|\n| `stripe` | Stripe | Secret Key, Publishable Key, Webhook Secret |\n| `paypal` | PayPal | Client ID, Client Secret, Mode |\n\n### π§ Email & Communication (3)\n| ID | Service | Fields |\n|----|---------|--------|\n| `sendgrid` | SendGrid | API Key |\n| `mailgun` | Mailgun | API Key, Domain |\n| `twilio` | Twilio | Account SID, Auth Token, Phone Number |\n\n### π Analytics & Monitoring (3)\n| ID | Service | Fields |\n|----|---------|--------|\n| `datadog` | Datadog | API Key, Application Key |\n| `sentry` | Sentry | DSN, Auth Token |\n| `newrelic` | New Relic | License Key, App Name |\n\n### π DevOps & CI/CD (2)\n| ID | Service | Fields |\n|----|---------|--------|\n| `docker` | Docker Hub | Username, Password |\n| `npm` | npm | Access Token |\n\n### π‘οΈ VPN & Network (2)\n| ID | Service | Fields |\n|----|---------|--------|\n| `vpn` | VPN Credentials | Server, Username, Password, Config |\n| `ssh` | SSH Key | Host, Username, Private Key, Passphrase |\n\n### π§ Custom / Generic (4)\n| ID | Service | Fields |\n|----|---------|--------|\n| `api-key` | Generic API Key | API Key, API Secret, Base URL |\n| `oauth` | OAuth Credentials | Client ID, Client Secret, Redirect URI, Access Token, Refresh Token |\n| `basic-auth` | Username & Password | Username, Password |\n| `bearer-token` | Bearer Token | Token, Base URL |\n\n---\n\n## π Commands\n\n### Core Vault\n\n| Command | Description |\n|---------|-------------|\n| `envlock init` | Initialize vault with master password |\n| `envlock create
\n Built with π by John & Neo\n
\n\n\n GitHub β’\n npm β’\n Quick Start\n
\n","readmeFilename":"README.md"}