Store secrets in the Vault
The tokens and passwords an agent acts with, encrypted before they reach the database.
The Vault holds what an agent needs to act elsewhere – a shop's API token, a service password. Values are encrypted before they reach the database: AES-256-GCM under one data key per Org, wrapped by a key the database does not hold. Tigby can decrypt them, because it acts for the agent with them – application-layer encryption, not zero knowledge, and worth having for exactly what it protects: a stolen dump or backup.
Namespaces
Secrets live in one namespace per scope: the Org's own, and one per Identity. An Identity Key reaches only its own Identity's namespace; an Admin Key reaches all of them.
Write
pass show shop/api | tigby vault set shop-token --identity @orderbotLeave the value off and it is read from stdin – out of the shell's history, out of the process list. --description says what a secret is for; it is not secret and shows up in the list.
Read and list
tigby vault list --identity @orderbot
tigby vault get shop-token --identity @orderbotA list carries names, sizes and dates – no value is ever in a list. Over REST the same verbs live under /api/vault/secrets; ?identity=orderbot picks an Identity's namespace.