In short:
ak-vaulthandles the secrets side whenever your task touches an API key, a token or a.env.*file. It recommends AgentKit'sak secretsvault but follows the store you chose, including.env.*files or another secret manager. It never prints a secret value, and it does not run grant, recovery or conflict-resolution commands for you.
Disclosure: I maintain AgentKit and have an affiliate relationship with it: the AgentKit link in this post is an affiliate link; buying through it gets you 30% off.
Summary
Use it when your task needs to store, find, rotate, sync, import or use a credential, or runs into .env.* files, including a deploy or API call that needs a key. The AI only reports ref names, counts, exit codes and [redacted], never values.
flowchart LR
A["Task needs a key, token or .env file"] --> B["ak-vault"]
B --> C["Read the recorded store choice"]
C --> D["ak secrets vault: store, find, sync, use, rotate"]
C --> E[".env.* files: follow the project's files"]
C --> F["Another manager: its own way"]Four things it always takes care of:
| Concern | Question | Example |
|---|---|---|
| Where secrets live | Where do you keep secrets, for this project or every project? | AgentKit's vault for every project, .env.* for this project only, or external:1password |
| Refs and metadata | How will you find this secret later? | Ref SHOP_STRIPE_API_KEY tagged with project shop, environment production, provider stripe |
| Checking without seeing the value | How do you know a ref holds the right key without anyone looking at it? | hint shows the public prefix and last 4 characters; ak secrets compare returns match or differs |
| Commands you run yourself | What will the AI not do for you? | ak secrets approve when a command using ${secret:...} has no permission yet |
It asks for your store choice only once, and only when someone can answer; in CI or with --json it follows what the project already does. Granting or approving permissions, resolving sync conflicts, recovering the vault and turning on sync are commands you run in your own terminal; before deleting a ref it asks you first, because a deleted ref cannot be recovered.
Sample prompt for storing a key for the first time:
/ak-vault store Store the <provider> key for the <project name> project.
The value is in the <VAR_NAME> variable in .env.production.
Do not print the value.This skill has no flags. You type the action (store, find, sync, use, rotate, import), then a ref or a .env file path.
Below is the detailed version: the run flow, 6 situations with prompts, the change history by ak release, and common pitfalls. The detailed version and the interactive page are for subscribers. Your agent can also search them through the portal's MCP.
Opens when your account has subscriber access
This guide is for subscribers
Once your account has access, the full piece, the interactive visual and the agent call all open.
- Sign in or create a modernEngineer accountReading access belongs to your account email.
- Choose a plan on the pricing page1, 3 or 12 months, paid by VietQR bank transfer. Access opens about a minute after the money arrives.
- Or redeem a Facebook subscriber codePeople supporting the page on Facebook get an activation code by message each month.
Already a subscriber? Sign in to read.
Use this piece in your agent
Get an API keyCopy the text below and paste it into Claude Code, Codex or whichever agent you use. The agent reads the piece and checks it against the repo you have open.
Read "ak-vault: store and use secrets without exposing values" on modernEngineer and apply it to this repo.
1. Call the content_get tool of the modernengineer MCP server with locale "en", slug "ak-vault". If the modernengineer MCP server is not connected, stop and walk me through connecting it from https://modernengineer.dev/en/mcp.
2. Summarize the main steps of the piece and point out which apply to this repo.
3. Propose concrete changes and ask me before editing any file.Connect MCP in Claude Code (once)
claude mcp add --transport http modernengineer \
https://api.modernengineer.dev/mcp \
--header "Authorization: Bearer <API key>"Reading the full piece over MCP needs an API key from a subscriber account or one that bought this guide. Without access, the agent only gets the opening.
- Version
- v1.1.0
- Updated
- 01/11/2026
- Licence
- All rights reserved
- Slug
- ak-vault
