How it works
Your browser locks your vault. A broker on your computer uses your secrets. Your agents ask the broker. Here's what each part does.
You add a secret at wundervault.com. Your browser encrypts it before it's sent, using your passphrase and your Account Key, which never leaves your device. We store it locked.
You install the broker once, with one administrator command. It runs under its own account, so your agents, which run as you, can't open its files.
You confirm a short fingerprint in your dashboard. From then on, only requests signed by that broker can fetch a brokered secret.
Your agent asks the broker to call a service or sign an SSH login. The broker uses the secret and hands back the result.
Secrets set to "ask me first" wait for you before going anywhere new. You approve from your phone.
Any HTTPS service that takes an API key or token. Your agent says where and what; the broker attaches the secret and returns the answer without it.
"List my Cloudflare sites" → the broker calls api.cloudflare.com with your token → the list comes back.
Your agent runs a command on a server, or copies files to it; the broker signs the login. The key stays in the broker, and each key works only with the servers you list.
"Deploy to my server" → ssh to that host → the broker signs → connected.
When a service charges per request (x402), the broker pays in USDC on Base or Solana. Payments to payees you trust, within your daily limit, go ahead; the rest wait for you.
Your agent asks for a signature with a signing key you've added. You see exactly what's being signed, and approve it.
"Sign this release" → you approve → the signature comes back, the key stays put.
Coming soon
Being built now. None of these work yet; each arrives in a release of its own, and the changelog says when.
Your agent uses a website you've signed in to, in a browser the broker runs on your computer. It never sees your password.
Keep a site's two-factor setup in the vault. When a sign-in asks for the 6-digit code, the vault fills it in; your agent never sees the setup.
For things with a sign-in of their own, like a home router: the vault signs in and keeps the session, and your agent sees neither.
You approve a program and where the secret goes; the vault runs it with the secret, and your agent never sees it.
A code that works once, in place of your password, so an agent can run an admin command you've allowed without ever knowing the password.
with a key the vault keeps.
For routine secrets. Calls go ahead, every one is logged on your computer, and you can be emailed the first time a secret goes somewhere new.
For secrets that matter. A call to a new destination waits for your approval: once, or for a window you choose.