Vaults
The Vault is the foundation of 1Claw. Every secret, agent credential, signing key, and treasury private key lives in an org-scoped vault encrypted with keys that never leave the HSM.
What you can do
| Capability | Description | Learn more |
|---|---|---|
| Secrets | Store API keys, tokens, and credentials at path-based addresses | Human API → Secrets |
| Policies | Grant agents read/write access to path patterns with conditions | Golden path, Scoped permissions |
| Rotation | Server-side generate, version history, disable old versions | Rotating secrets |
| CMEK | Client-side AES-256-GCM layer; server never sees your key | CMEK |
| MPC | Split DEKs across HSM providers (2-of-2 or 2-of-3) | MPC |
| Sharing | Share secrets with people or agents via share links | Sharing |
Interfaces
| Interface | When to use |
|---|---|
| Dashboard | Day-to-day vault and secret management in the browser |
| Human API | Full REST API for owners (JWT or 1ck_ API key) |
| Agent API | Agents fetch secrets at runtime (JWT from ocv_ key) |
| MCP Server | Claude Desktop, Cursor, and MCP-compatible clients |
| CLI & SDK | CI/CD, env run, automation |
System vaults
Two vaults are auto-managed and hidden from the vault list:
__agent-keys— agent SSH/ECDH keys, signing keys, bindings, Bankr leases__treasury-keys— human treasury wallet private keys
Direct secret reads from system vaults return 403; use the designated export or reveal endpoints instead.