Request the bundle
A short-lived API key requests only the encrypted values in its permitted vault.
GET /api/v1/vaults/:id/bundle
Development secrets · under control
Delegate the work. Keep control of the keys.
Grounded Vault gives teammates, CI, and AI agents narrow, revocable access to encrypted development secrets—without pasting credentials into chats or prompts.
Public beta · start with a dedicated development vault
$ grounded pull billing-app --environment development --format env
→ authenticating gv_live_••••c91a
→ scope: vault/billing-app · read
→ downloading encrypted bundle
→ fetching key version 4
✓ decrypted locally · 12 secrets
STRIPE_SECRET_KEY=••••••••
OPENAI_API_KEY=••••••••••
DATABASE_URL=••••••••••••
Server behaviorNo plaintext secret responses
Default accessVault-scoped · read-only · 7 days
AccountabilityEvery access attempt is audited
Two calls. One local boundary.
Secrets stay encrypted until they reach the client.
Bundle retrieval and key retrieval remain separate, independently authorized events. Decryption happens on the developer's machine or inside the approved workload.
Fetch the key version
The matching vault key version is authorized and audited as a separate request.
GET /api/v1/vaults/:id/key_versions/4
Decrypt locally
The client decrypts the bundle records into JSON or a protected environment file.
grounded pull billing-app --environment development --format env
Least privilege, made visible
A delegation boundary you can inspect.
One token replaces a loose bundle of credentials. Its reach, lifetime, and history stay clear to the human who issued it.
Scope every credential
Grant access to one vault or an account, with read-only access as the safe starting point.
Expire access by default
Keys start with a seven-day lifetime, can be revoked immediately, and may be restricted by IP.
Audit allowed and denied access
See which key reached which vault, bundle, secret, or key version—and when it happened.
Safer delegation starts with a narrower key.
Grounded Vault is being built for developers and teams that want AI-assisted work without credential sprawl.
Create your workspace