SecretProxy.
Use a credential without putting it inside the application.
Can an application use a credential without holding it?
An application often needs permission to call an API, but it does not need to know the underlying credential. SecretProxy separates those two concerns by moving credential injection into an outbound proxy.
A product from OVRLab, with public architecture documentation and integration guides.
The request boundary
A service sends an ordinary HTTP request through SecretProxy with a placeholder in place of an API key. The proxy checks the registered target and binding, resolves the secret version, and injects the value into the outgoing header or body.
The upstream API receives an authenticated request. The calling application can keep the same placeholder when a credential changes; versioned bindings make rotation and rollback an operational change.
Design considerations
Exposure and authority
Keeping raw credentials outside application memory reduces exposure through logs and debugging tools. The application still has authority to make allowed calls, so limiting that authority remains essential.
Explicit destinations
Placeholders are scoped to registered targets. A binding specifies where a credential may be used, rather than letting each caller choose an arbitrary destination.
A trusted proxy
Credential injection moves the trust boundary. The proxy and its policies become part of both the security model and the request path.
Explore the project
The product site covers available plans. The documentation explains the architecture, bindings, and integration workflow.
Publications
Verify credential-key ownership before forwarding
A new request check verifies the key material in a credential reference before the proxy uses the stored secret, alongside the existing IP controls.
SecretProxyVersioned credentials and deliberate rotation
Secret versions and binding promotion make credential changes explicit, with checks that preserve tenant ownership and secret lineage.
SecretProxyEncrypted secret storage for SecretProxy
The secrets API now encrypts new credential values with AES-256-GCM, while the proxy recovers them only when preparing the outbound request.
SecretProxyCredentials at the point of egress
SecretProxy now resolves application placeholders into target-bound credentials, with a management interface connected to the request path.
SecretProxySecretProxy’s first forwarding prototype
A small Worker experiment forwards requests to an explicit set of destinations and pairs that request path with key-value storage.
SecretProxy