Skip to content

ARKCRON Developer Vault

Secrets out of your code. Access that expires.

Store API keys, SSH keys, certificates and tokens in an encrypted developer vault — and hand applications short-lived, scoped credentials instead of permanent ones.

Start buildingRead the docs
zsh — arkcron
$ arkcron login --passkey✓ Authenticated as dev@example.com (passkey · device trusted)$ arkcron run --env prod -- ./deploy.sh→ policy: prod-deploy · approver: not required · risk: low  injecting 3 secrets as env vars (never written to disk)  AWS_ROLE      sts session · ttl 15m  DB_URL        scoped read/write · ttl 15m  STRIPE_KEY    restricted key · ttl 15m✓ deploy finished · credentials revoked$ arkcron scan .! 1 hard-coded secret found in config/legacy.env:4  suggestion: arkcron import --from config/legacy.env --rotate$

Workflow

From laptop to cloud, without a static key.

The CLI authenticates you with a passkey and device trust, then brokers a credential that lives for minutes — not months.

Install & use
# install
brew install arkcron/tap/arkcron   # or: npm i -g @arkcron/cli

# authenticate with a passkey
arkcron login --passkey

# run a command with secrets injected as env vars
arkcron run --env staging -- npm run migrate

# use the SSH agent — keys never touch disk
export SSH_AUTH_SOCK=$(arkcron ssh-agent --socket)
  1. 01

    Developer

    Starts a task that needs access.

  2. 02

    ARKCRON CLI

    Requests access under a named policy.

  3. 03

    Authenticated session

    Passkey + device trust + risk check.

  4. 04

    Temporary credential

    ttl 15m

    Scoped token or cloud session, TTL in minutes.

  5. 05

    Application / Cloud

    Credential expires on its own; access is logged.

What it holds

Every credential a developer touches.

API keys & tokens

Versioned, rotatable, injected at runtime.

SSH keys

Generated in the vault, used through the agent with per-host approval.

Certificates

Track expiry and renew before outages.

Secrets

Environment-scoped values for dev, staging, prod.

Cloud credentials

Short-lived sessions brokered through your cloud's native identity services.

Secret scanning

Find hard-coded secrets in repos and move them into the vault.
CI/CD · .github/workflows/deploy.yml
- uses: arkcron/setup-cli@v1
  with:
    oidc: true            # no stored ARKCRON token
- run: arkcron run --env prod -- ./deploy.sh
SDK · server.ts
import { Arkcron } from "@arkcron/sdk";

const ark = new Arkcron({ identity: "workload-oidc" });
const db = await ark.credential("prod/db", { ttl: "15m" });

Ship without static secrets.

Free for individuals. No card required. Your keys stay on your devices from the first minute.

Get Started — FreeTalk to sales