Secrets Manager
Server-managed secrets API. Create vaults, store secrets, set a rotation schedule, and read back through access rules (applied to reads, writes, deletes and rotations) with a tamper-evident access log. Each secret gets its own key, derived with HKDF-SHA256 from QuantumRand entropy, or the OS CSPRNG if QuantumRand is unreachable — each secret records which.
Rotation is manual. A rotation schedule records when a secret is due; nothing rotates automatically yet.
Not zero-knowledge. You POST the secret value to the API and the service derives and holds the key, so it can decrypt your secrets. Encryption is Fernet (AES-128-CBC + HMAC-SHA256).
Storage. Secrets, their wrapped encryption keys and the access log are stored in Postgres and survive restarts and redeploys. There is no published backup, restore or uptime commitment yet.
curl -X POST https://vault-api.qntyx.io/vaults/ \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"https://vault-api.qntyx.io| Method | Path | Description |
|---|---|---|
POST | /vaults/ | Create a vault |
POST | /secrets/{vault_id} | Store a secret (body includes the plaintext value) |
GET | /secrets/{vault_id}/{secret_name} | Read a secret back by name |
GET | /secrets/{vault_id} | List a vault's secrets (metadata only) |
GET | /stats/ | Dashboard statistics |
All endpoints require a bearer token. See Authentication for details.
Manage this product visually at app-vault.qntyx.io
Learn more at vault.qntyx.io