LOOMAL
Start a project
Vault

Encrypted credentialsfor your agents.

A credential store designed for AI agents. Stash API keys, OAuth tokens, time-based codes, and a dozen other credential types. Every read writes an audit entry. The vault is not a payment processor — Loomal Pay handles money. Vault holds the secrets agents need to act on their own.

Read-once API keys, refreshable OAuth tokens, time-bound 2FA codes, payment cards with separate CVV access, SSH keys for deploy automation. Every secret stored here is encrypted at rest and only returned to your agent through an authenticated REST call. Every read writes an audit entry compliance teams can actually use.

Start a project →
Read docs

How it works

Four steps. Most fire in under a second.

01

Store a credential

POST a typed credential. Loomal validates the shape, encrypts it, and stores it with an audit entry.

02

Agent reads when it needs to act

GET the credential by name. For 2FA, request only the current code. The underlying seed stays encrypted.

03

Audit log captures every access

Each read writes an entry with project, time, source IP, and which agent triggered it. Filter by credential, by agent, by time range.

What you get

Built for developers who already shipped.

Encrypted with full audit log

All secrets are encrypted at rest. Every read writes an audit entry with project, time, source IP, and which agent triggered it.

2FA codes without exposing seeds

Store the seed once. Agents request the current 6-digit code on demand. The seed itself never leaves the vault.

12 credential types

Logins, API keys, OAuth, 2FA, databases, SMTP, AWS, SSH keys, certificates, cards, addresses, custom.

FAQ

Things builders ask.

Is the vault a payment processor?
No. Vault stores credentials so an agent can use them when needed. Loomal Pay handles actual payment settlement separately. Storing a card in Vault does not charge anyone.
What credential types are supported?
Twelve types: logins, API keys, OAuth tokens, 2FA, databases, SMTP, AWS, SSH keys, certificates, cards, shipping addresses, and custom. Each has a typed shape Loomal validates on write.
Can the vault be exported?
Decrypted secrets are returned through the REST API to your agent. There is no bulk export endpoint by design. Migrating off Loomal means reading each credential individually and writing it elsewhere.
How is 2FA different from a password manager?
Most password managers expose the 2FA seed. Loomal Vault does not — the seed stays encrypted and only the current 6-digit code is returned. A leaked agent token cannot be used to clone the 2FA into another device.

Built with Vault

Real things developers build
on top of Vault.

AI 2FA login
Bank statement fetch

Ready to ship vault?

Sign up for free. No card required. Read the docs while you wait.

Start a project →
Read docs