seekrit (local crypto plane)

Read the organization's audit trail (most recent first).

Compose a group into an application environment (higher position wins on name clashes).

Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.

Create an application in an organization.

Fork an environment into an ephemeral branch (a per-PR / preview config). The branch inherits the parent's secrets by layering at read time — nothing is copied or re-encrypted — and holds only the values you override on it. Generates the branch's data key locally, grants it to the caller, and shares it with the parent's other readers.

Create an application environment. Generates the data key locally and grants it to the caller.

Create a shared group (reusable secret bag) in an organization.

Create a group environment. Generates the data key locally and grants it to the caller.

Mint a short-lived MySQL/MariaDB credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its mysql_native_password hash is sent to the API — the plaintext never reaches seekrit or MySQL at rest. The user auto-expires; revoke early with revoke_mysql_lease.

Create an organization. Requires a user session — service tokens cannot own a Stytch org.

Mint a short-lived Postgres credential against a target and return a ready-to-use connection URL. The password is generated on THIS machine and only its SCRAM verifier is sent to the API — the plaintext never reaches seekrit or Postgres at rest. The role auto-expires; revoke early with revoke_pg_lease.

Mint a service token, printed once. Runtime tokens bind to one app environment (auto-granted its keys, so a command/agent can decrypt it). Pass admin:true for an org-scoped provisioning token (create apps/groups/envs, grant, mint tokens) — admin tokens need no env binding.

Tear down a branch config and every value it overrode. The parent environment is untouched.

Delete a secret from an environment.

Write the resolved secrets to a dotenv file on disk and return the variable names written (never the values). Use to materialize a .env for local tooling.

Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command). A revealed current value has its ${OTHER_SECRET} references expanded against this environment's own secrets; pass raw:true for the stored text instead. Pass `version` to read an earlier version instead of the current one (always as stored, never expanded).

The recommended first-project recipe: provision structure, store secrets, and use them without exposing values. Call this before doing anything else.

Grant a member (by email) or service token (by id) access to an environment's data key. Re-wraps the DEK to the grantee — the caller must already hold the key.

Create an org-scoped managed key. Material is generated locally and wrapped to each grantee (self plus any listed users/tokens); the server never sees it. Use the CLI for app/group-scoped keys.

Decrypt a ce1 blob. Supply the same `context` used to encrypt.

Encrypt a value under a managed encrypt key; returns a ce1 ciphertext blob. `context` (if given) is bound as AAD and must be supplied identically to decrypt.

Generate a data key under a managed encrypt key (envelope encryption). Returns the plaintext key (base64) and its wrapped form to store.

Grant a principal (user email or token id) use of a key's current version.

List managed KMS keys the caller can see (metadata only).

Sign a message with a managed signing key; returns an sg1 signature blob.

Verify an sg1 signature over a message using a signing key's published public key (no grant needed).

List applications in an organization.

List ephemeral branch configs in an application (optionally just one environment's).

List the groups composed into an application environment (precedence order).

List environments of an application.

List a group's environments (per-slug value sets).

List shared groups (reusable secret bags) in an organization.

List organization members and their public keys (for granting access).

List MySQL/MariaDB leases (the ledger — never secret material).

List registered MySQL/MariaDB provisioning targets for temporary credentials.

List organizations the caller can access.

List Postgres leases (the ledger — never secret material).

List registered Postgres provisioning targets for temporary credentials.

List a secret's version history: who wrote each version, when, and which ones were restores. Never returns values — pair it with restore_secret to roll back, or get_secret(version, reveal:true) to inspect one.

List secret names + versions in an environment (never values).

List an organization's service tokens (never the secret token strings).

Roll a secret back to an earlier version. The stored ciphertext is replayed as a NEW version (history is append-only, nothing is overwritten). Keyless — no decryption happens, so this works even without a key.

Revoke a MySQL/MariaDB lease now (drops the user immediately).

Revoke a Postgres lease now (drops the role immediately).

Revoke a service token by id.

Run a command with the resolved secrets injected as environment variables, and return its exit code + captured output. Secret VALUES are never returned — this is the preferred way to use secrets. process env > .env > app env > groups.

Encrypt a value locally and store it in an environment. A value may reference another secret as ${OTHER_SECRET}: the reference is stored literally and expanded whenever the secret is read, so it tracks the referenced value. Write $${OTHER_SECRET} for a literal.

Remove a composed group from an application environment.

Show the authenticated identity, its role, and accessible orgs.