The secrets layer your agents never see in plaintext.
FunctionFly Vault gives you two encryption modes: zero-knowledge (the server cannot decrypt your data) and server-side (for AI provider keys the platform must inject into LLM calls). Dynamic credentials spin up scoped AWS IAM and GitHub PATs on demand. Every plan includes the vault.
What you get
A vault built for AI agents that handle hundreds of credentials — not a credential manager with an API on top.
Zero-knowledge mode
AES-256-GCM with client-derived keys. The server stores ciphertext + IV/salt/tag — never the key material. You can prove compliance without being able to decrypt user data.
Server-side mode
For AI provider connections where the platform must decrypt to inject keys into LLM requests. Encrypted with per-tenant keys.
Dynamic credentials
Spin up scoped AWS IAM roles and GitHub PATs on demand with automatic rotation. The orchestrator issues short-lived credentials to functions — never the long-lived secret.
MFA-gated access
TOTP, passkeys, backup codes, SAML SSO, and SCIM provisioning. Sensitive operations require fresh MFA even for already-authenticated sessions.
Namespaces & expiration
Per-tenant namespaces. Per-secret expiration and rotation reminders. Audit trail for every read, write, and decrypt.
Scoped capability grants
Functions and agents never see raw vault credentials — they get short-lived, policy-scoped grants enforced by the broker. Audit trail, kill-switch, and per-tenant revocation built in.
Production-launch readiness
What's in general availability today, what's running in shadow mode, and what's queued for staging.
Stop pasting API keys into env files
Every plan ships with vault features included. Free tier starts at 25 secrets and 100 dynamic credentials.