About Koove
Zero-knowledge secrets management for developers
Our Story
Koove started from a shared frustration: storing API keys, tokens, and credentials securely is still too hard for anyone who isn't a security expert. In practice, secrets end up in environment variables, unencrypted .env files, or chat messages.
We saw a gap between the existing tools. Traditional secrets managers trust the server to see secrets in the clear, and mobile attestation solutions don't cover a secret's full lifecycle. Something was missing that combined zero-knowledge encryption, device attestation, great developer experience, and an accessible price.
So we built Koove: a platform where secrets are encrypted end to end and only decrypted on cryptographically verified consumers. The server never sees your secrets in the clear. Our goal is to make storing credentials securely the default path, not the exception.
Our Mission
To make storing API keys and credentials securely the default, easy path for developers who aren't security experts. We believe strong secrets protection shouldn't require a PhD in cryptography.
Our Vision
A world where no secret travels or sits in the clear for the sake of convenience. Where zero-knowledge encryption and consumer verification are the natural foundation of any app that handles credentials.
Our Values
Zero-Knowledge by Design
The server never sees your secrets in the clear. Encryption happens at the edge and decryption only on verified consumers.
Great Developer Experience
Security that gets in the way doesn't get used. We designed the SDK so integrating Koove takes minutes, not weeks.
Technical Honesty
We explain exactly what we protect and what we don't. No overselling and no marketing we can't back up.
Consumer Verification
Secrets are only decrypted where they should be: devices with attestation and biometrics, or authorized backends.
Privacy as a Foundation
We treat the confidentiality of your secrets as a fundamental requirement, not a premium feature.
Auditable Open-Core
The SDK and encryption primitives are open source. Anyone can audit them: that's the proof of our zero-knowledge claim.
Security Model
How Koove protects your secrets end to end, from encryption to the verified consumer.
Envelope Encryption
End-to-end encryption
Each secret is protected with envelope encryption: X25519 for key exchange and AES-256-GCM for the data itself.
Verified Consumers
Controlled decryption
Decryption only happens on cryptographically verified consumers: an authorized device or an authorized backend.
Attestation + Biometrics
Mobile edge
On mobile we use Apple App Attest and Google Play Integrity together with biometrics to verify the device before decrypting.
Zero-Knowledge Server
Control plane
The server coordinates access and detects anomalies, but never sees your secrets in the clear. Zero-knowledge end to end.
Open-Core Approach
Open Source SDK
The client SDK and encryption primitives are open and auditable by anyone.
Encryption Primitives
The code that encrypts and decrypts is public, so you can verify for yourself that it's zero-knowledge.
Control Plane
The control plane that manages access to secrets is closed and operated by us.
Attestation Verification
The engine that validates App Attest and Play Integrity is part of our commercial core.
Anomalies & Dashboard
The anomaly detection engine and the admin dashboard round out the managed offering.
AI-generated code
Your AI writes the code. Who guards the secrets?
The most common security failure in AI-generated apps is exposed credentials. With Koove, your own assistant stores every token from the CLI — encrypted on your machine, never in the code or the repo.
Join our mission
We want storing secrets securely to be the default path. If you share that mission, let's talk.
Contact us