Zero-knowledge secrets manager for developers
Koove encrypts your API keys, tokens and credentials end-to-end and decrypts them only on devices verified with mobile attestation and biometrics. Auditable envelope encryption (X25519 + AES-256-GCM): not even Koove can read your secrets. Born for the AI-generated code era: your coding assistant stores secrets from the CLI, and your app ships without a single exposed credential.
Security for the AI-generated code era
More and more applications are written with AI assistants — Claude Code, Cursor, Copilot. Code ships faster than ever; secrets security cannot be left behind.
When an AI generates your application, the biggest security risk is no longer an exotic bug: it is the API keys and tokens pasted into the code, the .env pushed to the repository, or the credential embedded in the app binary. Thousands of secrets leak into public repos every day, and a growing share comes from code generated at full speed without secure credential management.
Koove was born with this goal: protecting a secret should be one command, not a discipline. Your own AI assistant can use the Koove CLI to safeguard every token and credential the moment it appears — it is encrypted on your machine with end-to-end encryption, and only the ciphertext envelope reaches the server. Your code and your repository work with key names, never with plaintext values.
$ koove set STRIPE_SECRET_KEY "sk_live_••••••••" --env prod✔ Encrypted locally (X25519 + AES-256-GCM)✔ Uploaded ciphertext envelope only — the server cannot read it$ grep -r "sk_live" src/(no matches — your code only knows the key name)
The CLI encrypts on your machine: only the ciphertext envelope reaches the server. Neither your repository nor Koove ever sees the plaintext value.
The AI stores, never exposes
Your coding agent runs "koove set" and the secret is encrypted end-to-end (zero-knowledge). It never ends up hardcoded in the code, in the repo, or in the app bundle.
Your code only knows names
Generated code references keys by name (DATABASE_URL, STRIPE_KEY); the value only decrypts on a verified consumer: an attested device with biometrics or an authorized backend.
Professional apps from day one
Mobile attestation, a cryptographic kill-switch, key rotation and audit logs: the result is a secure, robust app ready for professional distribution — even if most of it was written by an AI.
Secrets management with end-to-end encryption
Everything a development team needs to store credentials securely: zero-knowledge by default, real attestation, and server-side anti-theft.
True zero-knowledge
Your secrets are encrypted on the client before they leave. The server stores only ciphertext and sealed keys — Koove never sees a plaintext credential or a private key. And it is auditable, because the encryption primitives are open source.
Envelope encryption
Each secret is encrypted with a unique data key (AES-256-GCM) that is sealed per consumer public key with X25519. Adding a device, revoking, or rotating keys is a re-seal, not a re-encryption.
Mobile attestation (App Attest / Play Integrity)
A secret only decrypts on a device cryptographically verified with Apple App Attest or Google Play Integrity, plus biometrics. The untrusted client never receives keys unless it passes attestation.
Credential management and key rotation
Store API keys, database passwords and tokens scoped per environment (dev, staging, prod). Rotate the controller identity or the recovery code with a single command, with zero downtime.
Cryptographic kill-switch and revocation
Revoke a device and remove it from every secret with a re-seal. Honest: what was already delivered is not un-delivered — for a total kill, rotate the value. No magic promises.
Server-side anti-theft
Anomaly detection (new IP, read velocity, failed attestations) and canary tokens (decoys whose read confirms a breach). Controls a compromised client cannot switch off.
How zero-trust secret access works
1. Encrypt and store
With the Koove CLI you encrypt the secret locally for the recipient set and upload only the encrypted envelope. The server never sees the value.
2. Verify the device
The mobile app runs real attestation (App Attest / Play Integrity). The server verifies it and marks its public key as an eligible recipient.
3. Decrypt with biometrics
The SDK decrypts the secret in memory after FaceID / fingerprint. It never touches disk in the clear or leaves the verified device.
4. Control the lifecycle
Add devices, revoke them with a cryptographic kill, recover with a BIP39 code and rotate keys — all with idempotent, audited commands.
Why Koove over other secrets managers?
Hardened mobile SDK
A HashiCorp Vault and Infisical alternative built for the mobile edge: a React Native and Expo SDK with attestation, biometrics and hardware-backed storage. Secure is the default, easy path.
Open-core and auditable
The client SDK and the encryption primitives are open source: the zero-knowledge promise can be verified, not just believed. No black boxes on the secret path.
Accessible pricing
Enterprise-grade security (attestation, zero-knowledge, anti-theft) without enterprise pricing. A free plan to start and Stripe billing to scale as you grow.
Use cases
- ✓Let your AI assistant (Claude Code, Cursor, Copilot) store tokens with the CLI while it generates the code — no hardcoded secrets, no .env in the repo.
- ✓Protect API keys and tokens in React Native mobile apps without exposing them in the binary.
- ✓Distribute database credentials to backend services and CI/CD pipelines.
- ✓Meet security and audit requirements with access logs and SIEM export.
- ✓Rotate and revoke compromised third-party credentials without redeploying the app.