Application
Your app holds a VaultProof project value
Supported SDKs keep their existing environment-variable names. VaultProof supplies a vp-proj-… value and a provider-compatible base URL.
App holdsvp-proj-…
Rebuilding your trust between machines
API key protection for developers building AI agents, apps, and CI/CD workflows.
Your API keys are copied into every system you run
Apps, build systems, laptops, and AI agents often hold the same live provider credential. Every copy creates another place to leak. If one copy escapes, it may grant direct provider access from anywhere.
A leaked key still works until you revoke it
Your team may still be searching repositories, logs, laptops, and running environments when the key must be rotated. The exposed credential remains usable during that gap.
Attackers can reach the provider before you see the leak
Attackers automate secret discovery, validation, and provider requests. The first unauthorized request can arrive before the exposure reaches the team that owns the key.
Reduce raw-key exposure before the next leak
Repository scanning helps find credentials that have already reached source control. VaultProof Active Key Protection reduces the raw provider-key copies held by supported application runtimes.
Find existing exposure
Scan repositories for credentials that have already reached source control.
Scan for exposed keys
Reduce future copies
Move supported provider keys out of application configuration.
Set up Active Key ProtectionSee Active Key Protection in 60 seconds
Watch a provider key move out of application configuration and into the VaultProof request path.
Know where your provider key exists and when it is used
VaultProof separates the value held by your application, the encrypted key shares in storage, and the proxy that authenticates provider requests.
Custody
The provider key is split before storage
VaultProof stores two authenticated ciphertext shares separately. Normal application flows cannot retrieve the raw provider key.
StorageTwo separate encrypted shares
Review the security modelRuntime
The proxy reconstructs the key for the provider request
The proxy authenticates the outbound request. Raw key material stays inside the proxy request path while VaultProof records safe operational metadata.
Activity recordprovider · route · status · latency
Review Activity LogsProtect one provider key from your terminal
curl -fsSL https://vaultproof.dev/install | sh
Confirm the protected request
Example Activity Log- Provider
- openai
- Route
- /v1/chat/completions
- Status
- 200
- Latency
- 50 ms
Protect your first provider key
-
Install
Install the CLI, then open your app directory.
-
Inspect
Run
vaultproof-init --dry-runto see supported provider keys without rewriting a file. -
Apply
Add the generated
vp-proj-…value and base URL to the server-side environment, then restart or redeploy. -
Verify
Make one real provider request and confirm that the protected route appears in Activity Logs.
Let ChatGPT inspect protection without accessing provider keys
VaultProof's remote Model Context Protocol server gives ChatGPT ten read-only tools for project status, protected credential metadata, usage, activity, alerts, integration health, and MCP connections. Public tools cannot return credentials, scan source code, modify your app, manage billing, or call providers.
- Public tools
- 10
- Authorization
- OAuth + PKCE S256
- Access
- Read only · revocable
Requires an existing VaultProof account. ChatGPT Developer Mode availability depends on account and workspace policy.
Production endpoint
10 READ-ONLY TOOLS
https://mcp.vaultproof.dev/mcp
ChatGPTOAuthVaultProof MCP
vaultproof.credentials.list
Lists protected credential labels, providers, projects, and states without key values.
vaultproof.integration.guide
Returns safe guidance for placing VaultProof at the server-side provider boundary.
Response boundary Raw credentials, token values, internal IDs, source files, mutations, and provider execution are excluded from the public tool surface.
Answers developers need before setup
What changes in my application?
For supported providers, existing SDK and environment-variable names stay in place. VaultProof replaces the provider-key value and adds a provider-compatible base URL so requests pass through the proxy.
Where does the provider key exist?
VaultProof stores it as two separate authenticated ciphertext shares. The proxy reconstructs the key inside the request path to authenticate the outbound provider request.
What if a vp-proj-… value leaks?
It cannot reveal the original provider key through raw retrieval, but it may authorize proxy traffic until origin, rate, or revocation controls stop it. Treat it as a runtime credential.
Does VaultProof replace secret scanning?
No. Scanning finds credentials that reached source control. Active Key Protection reduces the raw provider-key copies held by supported application runtimes. They address different parts of the exposure problem.
Move one raw API key out of your app
Create a free account, protect one supported provider, and verify the first routed request in Activity Logs.