Skip to main content

​
What It Does

Hexr Vault provides encrypted secret storage for AI agents. Secrets are:
  • Encrypted at rest with AES-256-GCM
  • Scoped per agent using SPIFFE ID — agents can only access their own secrets
  • Stored in PostgreSQL (no external vault dependency)
  • Accessible via SDK through hexr.vault module

​
How Access Works

1

Agent requests secret

Your code calls vault.get("OPENAI_API_KEY") via the Hexr SDK.
2

SDK routes through Envoy

The SDK sends GET /api/v1/secrets/OPENAI_API_KEY to the Envoy proxy sidecar.
3

Envoy extracts SPIFFE ID

Envoy extracts the SPIFFE ID from the mTLS connection and adds it as the x-hexr-spiffe-id header.
4

Vault verifies scope

The Vault Service verifies the SPIFFE ID matches the secret’s configured access scope.
5

Decrypt and return

The secret is decrypted (AES-256-GCM) and the plaintext value is returned to the agent.

​
Scoping Model

Secrets are scoped to a SPIFFE ID prefix:

​
Storage

Backend: PostgreSQL with the pgcrypto extension.

​
API Endpoints

​
Configuration

​
Image