Usage Examples
See how teams integrate Koove to manage secrets with end-to-end encryption. From mobile apps to CI pipelines and backend services, these examples will help you get started quickly.
Protect API keys in a React Native app
Fetch encrypted secrets on the device. The key is only unsealed after attestation (App Attest / Play Integrity) and biometrics pass; plaintext never leaves the enclave.
import { Koove } from '@koove/react-native';
// The SDK runs attestation + biometrics before unsealing
const koove = new Koove({ appId: 'app_mobile_prod' });
async function loadStripeKey() {
// Attestation challenge (App Attest / Play Integrity)
await koove.attestDevice();
// Requires biometrics; local decrypt via envelope encryption
const stripeKey = await koove.getSecret('STRIPE_API_KEY', {
env: 'prod',
requireBiometric: true,
});
// Plaintext only lives in device memory
return new StripeClient(stripeKey);
}Deliver DB credentials to a backend in CI
Authorize a backend service as a verified consumer and hand it the encrypted connection string at deploy time, without exposing it in plaintext environment variables.
import { Koove } from '@koove/node';
// The backend authenticates as an authorized control-plane consumer.
// The server only returns ciphertext + a sealed key to the service.
const koove = new Koove({
serviceId: process.env.KOOVE_SERVICE_ID,
serviceKey: process.env.KOOVE_SERVICE_KEY, // consumer key
});
export async function getDatabase() {
// Decrypt in-process; Koove never sees the plaintext string
const dsn = await koove.getSecret('DATABASE_URL', { env: 'prod' });
return new Pool({ connectionString: dsn });
}Rotate a compromised secret with the CLI
On a leak, trip the cryptographic kill-switch and publish a fresh value. Revoked consumers stop decrypting immediately; verified ones receive the rotated key.
# Revoke current access to the secret (cryptographic kill-switch)
koove device-revoke --device ios-old-build --reason compromised
# Publish the new value encrypted for verified consumers
koove set STRIPE_API_KEY sk_live_new_value --env prod
# Rotate the controller key that seals per-environment keys
koove controller-rotate --env prod
# Verify who can decrypt after rotation
koove device-list --env prodProject init and per-environment scope
Initialize a project, store secrets scoped to dev/staging/prod, and approve the devices allowed to read them. Each environment has its own sealed key.
# Initialize the project and generate base key material
koove app-init acme-payments
# Store secrets scoped per environment
koove set DATABASE_URL "postgres://..." --env staging
koove set DATABASE_URL "postgres://..." --env prod
# Approve a device after reviewing its attestation
koove device-approve --device pixel-ci-runner --env staging
# Show the recovery code (BIP39, 24 words)
koove recover-showAnomaly detection and canary tokens
The control plane flags reads from new IPs, abnormal velocity, or failed attestations, and an encrypted canary token fires an alert if someone tries to read a decoy secret.
import { Koove } from '@koove/node';
const koove = new Koove({ serviceId: process.env.KOOVE_SERVICE_ID });
// Subscribe to control-plane anomaly events
koove.on('anomaly', (event) => {
// event.type: 'new_ip' | 'read_velocity' | 'attestation_failed'
if (event.type === 'attestation_failed') {
alertSecurityTeam(event); // forward to SIEM via audit log export
}
});
// A canary token: any read is a signal of compromise
koove.on('canary_triggered', (event) => {
pageOnCall(`Canary read: ${event.secretName} from ${event.ip}`);
});AI-generated code
Your AI writes the code. Who guards the secrets?
The most common security failure in AI-generated apps is exposed credentials. With Koove, your own assistant stores every token from the CLI — encrypted on your machine, never in the code or the repo.
Ready to get started?
Try Koove for free and discover how to manage your secrets with zero-knowledge end-to-end encryption.