Question 1

What is Koove?

Accepted Answer

Koove is a zero-knowledge secrets manager for developers. It encrypts your API keys, tokens and credentials end-to-end and only allows decryption on cryptographically verified consumers: a mobile device with attestation and biometrics, or an authorized backend service. Koove's server never sees your secrets in the clear.

Question 2

My code is generated by an AI (Claude Code, Cursor, Copilot). Why do I need Koove?

Accepted Answer

Because the most common security failure in AI-generated code is exposed secrets: hardcoded API keys, .env files pushed to the repo, or credentials embedded in the binary. With Koove, your own AI assistant stores every token with the CLI ('koove set') the moment it appears: it is encrypted on your machine and the generated code only references the key by name. The result is a secure, robust app ready for professional distribution, without a single plaintext secret in the code.

Question 3

What does 'zero-knowledge' mean for a secrets manager?

Accepted Answer

Zero-knowledge means Koove (the service) cannot read your secrets. They are encrypted on the client before upload; the server only stores ciphertext and sealed keys, never a private key or a plaintext value. Because the encryption primitives are open source, the promise is auditable: it can be verified, not just believed.

Question 4

How does Koove encrypt credentials technically?

Accepted Answer

Koove uses envelope encryption: each secret is encrypted once with a random data key using AES-256-GCM, and that key is sealed separately for each consumer's public key with X25519 (ECDH) + HKDF-SHA256. Adding a device, revoking it, or rotating keys is a re-seal of the key, not a re-encryption of the secret.

Question 5

What is mobile attestation and why does it matter?

Accepted Answer

Attestation cryptographically verifies that a request comes from a genuine app on a real, uncompromised device, using Apple App Attest (iOS) and Google Play Integrity (Android). Koove verifies attestation on the server and only then marks the device's public key as an eligible recipient of a secret. The client is never trusted on its own.

Question 6

How is Koove different from HashiCorp Vault or Infisical?

Accepted Answer

Koove's differentiator is the intersection of strict zero-knowledge, real mobile attestation, good developer experience and accessible pricing — a gap the alternatives leave open. Koove is built for the mobile edge with a hardened React Native and Expo SDK, while for backend/CI it offers a managed mode with rotation and integrations.

Question 7

Can I try Koove for free?

Accepted Answer

Yes. The Developer plan is free and includes 1 user, 1 application and up to 10 secrets, with the full mobile SDK (attestation and biometrics). You can upgrade to Starter or Business as your team grows, with no long-term contracts.

Question 8

Which platforms and languages does the SDK support?

Accepted Answer

The mobile SDK integrates with React Native and Expo (iOS and Android). The encryption primitives (@koove/crypto) are pure, auditable JavaScript, and the zero-knowledge CLI runs in any Node.js environment — ideal for writing secrets, backend services and CI/CD pipelines.

Question 9

What happens if I lose all my devices?

Accepted Answer

When you create an app, Koove generates a 24-word recovery code (BIP39) shown only once and never stored. With that code you can decrypt your secrets (break-glass) or register a new device. Every use of the code is audited and triggers an active security alert.

Question 10

How do I revoke a compromised device?

Accepted Answer

You revoke the device and the cryptographic kill-switch removes it from every encrypted envelope with a re-seal: it stops being a recipient and cannot decrypt future versions. We are honest about the limit: a secret the device already downloaded and cached is not un-delivered — for a total kill, rotate the secret's value too.

Question 11

How does Koove detect credential theft?

Accepted Answer

The real control lives on the server, where a compromised client cannot switch it off. Koove detects anomalies (reads from a never-seen IP, abnormal read velocity, repeated failed attestations) and supports canary tokens: decoy secrets whose read confirms a breach. Both trigger alerts.

Question 12

Can I manage separate environments (dev, staging, prod)?

Accepted Answer

Yes. Every secret is scoped per environment (dev, staging, prod), and you can manage devices, rotations and audit per application. Rotating the controller identity or the recovery code is a single, idempotent command with zero downtime.

Question 13

Can I cancel my subscription anytime?

Accepted Answer

Yes, you can cancel anytime and keep access until the end of the billed period. Billing is via Stripe (monthly), with no long-term contracts or penalties.

Frequently Asked Questions

Still have questions?