Keep Secrets
Privacy & Keys
API keys and other secrets are ECIES-encrypted to an executor's TEE public key — visible on-chain only as ciphertext, decrypted only inside the enclave.
Secret Encryption
This runs the actual ECIES encryption used by the app (12-byte AES-GCM nonce, same as Ritual expects) against a throwaway keypair generated in your browser — the ciphertext below is genuine, not a mock string.
In a request, the plaintext key name (e.g. API_KEY) is used as a placeholder in headers/URL/body. The executor decrypts this blob inside its TEE and replaces every literal occurrence of that placeholder — the real value is never visible on-chain.
SecretsAccessControl
Lets a secret owner grant another address (a contract, a delegate) time-limited, policy-scoped access to their encrypted secrets — restricted by destination host, HTTP method, path, and headers if desired. The executor checks this on-chain grant before decrypting on a delegate's behalf.
X402 Micropayments
Runs on top of the HTTP precompile: encrypted payment credentials are injected the same way as any other secret, enabling pay-per-call access to metered APIs without a subscription or a separately managed payment key.