secretserver.io

After Dark Systems / Secret infrastructure

Keep your secrets.
Move your work forward.

Secrets, credentials, protected PDFs, and signing operations. One platform to connect the people, machines, and software that depend on them.

Get started Explore the API

Scoped access. Version history. Built for automation.

NewSwatAuth push sign-in. Somebody's trying to sign in as you. Swat it.
Sculptural graphite vault with precision-cut brass frames
01 / A foundation for controlled access
From a single key to your infrastructureREST APIClient SDKsDevice identitiesHSM operationsProtected documents

01 / The platform

Control the secret.
Connect the workflow.

Give each application the access it needs, and give your team a consistent way to manage it.

A home for every credential

Manage passwords, SSH keys, certificates, service configuration, and other credential types in organized containers.

Access with boundaries

Use scoped API keys, expiring shares, and exact device grants. Keep signing operations separate from private key export.

Designed to be automated

Retrieve secrets by path, resolve named variables, and connect deployment workflows through the CLI, SDKs, Terraform, and Ansible.

Secret Server + DarkStorage

Keep your IP, secret.

Store encrypted PDFs and share watermarked previews with people in your account. Set an expiry, revoke access, and choose separately who can download the original or print pages.

Available when protected documents are enabled by your operator. Up to 8 MiB and 50 pages per PDF. View-only access withholds the original file; visible content can still be captured.

Manage documents How protection works

Secret Server + SwatAuth

Somebody's trying to sign in as you.
Swat it.

SwatAuth is push-approval sign-in for the applications you enroll. When a sign-in needs you, you see who, where, and which app, and you answer yes or no.

  • Number matching. Approve by typing the two-digit number on the sign-in screen. Wrong number, no entry.
  • The authenticator you already have. Duo Mobile, Google or Microsoft Authenticator, 1Password: any app that reads a QR code works for six-digit codes.
  • Backup codes. Ten one-time codes for the day your phone is somewhere else.
  • A fraud button. “This wasn't me” denies the request and locks the account until an administrator clears it.
  • Any application. Enroll an app and it calls a signed API with its own Ed25519 key. No shared secrets.

Push approvals run in the ss command line today. Mobile apps are on the way.

Set up SwatAuth Enroll an application
SwatAuth / Sign-in requestExpires in 60s
Customer portal
Account
you@example.com
From
203.0.113.24 · Lisbon, PT
Browser
Firefox on macOS
Type the number on your sign-in screen
Example request. A wrong number denies the sign-in.
  1. 01

    Your app asks

    Your application sends a signed request to SwatAuth and shows a two-digit number on its sign-in screen.

  2. 02

    You check

    Your device shows the app, the account, and where the sign-in comes from. Type the number to approve.

  3. 03

    You swat

    Approve, deny, or report fraud. Your application learns the answer: approved, denied, fraud, or expired.

02 / The software

Tools with a purpose.
A system that connects.

All software
01

SecretSauce

macOS security

Local security monitoring, investigation, and firewall controls for macOS.

02

aikeys

Developer tooling

Named secrets for coding agents, backed by an encrypted vault or native keychain.

03

SecretServer Agent

Device access

Enroll machines and deliver assigned secrets using a signed device identity.

04

AutoHSM

Vault operations

Distributed Vault unseal automation with wrapped shares and seal-state alerts.

05

Client libraries

SDKs & integrations

Python, TypeScript, PHP, Go, Ansible, and an operation-only MCP bridge.

03 / The API

Your infrastructure.
Your interface.

A rich REST API for secrets, certificates, identity, signing, device access, and database credentials. Browse the endpoint directory or start with a client library.

API documentation Client libraries
REST / Path-based accessGET
curl --fail-with-body \
  https://api.secretserver.io/api/v1/s/production/db-password \
  -H "Authorization: Bearer $SS_API_KEY"
One stable path. Access checked on every request.

Put it to work

Build on a quieter foundation.

Read the documentation