Encrypted secrets

Give the agent the tool. Keep the credential. A secret is an API key or other credential you save on your Proofable Profile. Proofable encrypts it, keeps it on your profile, and uses it for you when a tool call needs it. The value is never returned: not to you, not to the AI app you are using, and not to an agent.

Where a saved key works

Save a key once and use it everywhere you work with Proofable. Nothing needs to be re-entered per app.

Where	How the key is used
Proofable assistant	Pick the provider in the assistant. Proofable calls it with your saved key instead of the included model access.
Jobs	A job that runs on your provider uses the same saved key for its model calls.
ChatGPT, Claude, Cursor, and other MCP apps	`proofable_capability_call` calls the provider with your saved key. The app receives the provider’s answer, never the key.
Remote MCP connections	Headers for a saved MCP connection are stored the same way and sent only to that server.
Agents you create	Bind a secret to an agent. The agent can use it through Proofable, but cannot read it.

Add a key

Profile → Secrets (recommended). The value goes from your browser straight to Proofable.
From an AI app with proofable_secret_create. This works, but the value you type passes through that app’s conversation first. Use the Secrets page for production credentials.

Name a key after its provider, such as OPENAI_API_KEY or ANTHROPIC_API_KEY, so Proofable knows which provider it belongs to. For a provider Proofable does not recognize, pass tags: ["provider:<id>"] to proofable_secret_create.

Common questions

Can I see a saved key again? No. After saving, you see its name, type, and when it changed. To change it, save a new value. Who can read the value? No response from Proofable contains it. The service decrypts it only at the moment it makes a call you asked for, and sends it only to that provider. How is it stored? As a private encrypted record on your profile, sealed with AES-256-GCM. How do I rotate a key? Save a new value under the same name. The new value replaces the old one, and the old record is revoked. What does revoke do? It permanently deletes the stored record. Database backups that still contain it expire within seven days. If a key was exposed, also revoke it at the provider. Does Proofable use its own keys? The included assistant tiers use Proofable’s model access. When you add your own key for a provider, your requests to that provider use your key.

MCP tools

Sign in first with OAuth or a server key (Auth). When signed in, omit walletAddress; secrets bind to the profile from proofable_context.

Tool	Purpose
`proofable_secret_create`	Save or replace a named secret
`proofable_secret_list`	List secret names, types, and update times. No values
`proofable_secret_revoke`	Permanently delete a secret by proof ID

Create

{
  "alias": "OPENAI_API_KEY",
  "secretType": "single",
  "content": "<your-secret-value>"
}

Field	Notes
`alias`	Letters, numbers, and underscores; starts with a letter
`secretType`	`single` (default), `bundle` (key-value JSON), or `json` (one sealed JSON document)
`content`	The value to save. It is never returned
`tags`	Optional. `provider:<id>` links the secret to a provider Proofable does not infer from the alias
`walletAddress`	Optional when signed in; must match the signed-in profile if set

Saving the same alias again revokes the older record. The result lists revoked proof IDs in superseded. If revocation fails after the new save, the tool reports secret_replacement_incomplete with both proof IDs so you can retry or revoke the older one.

List

{ "limit": 50, "offset": 0 }

Without sign-in, the tool returns an empty list with authRequired: true and no metadata.

Revoke

{ "qHash": "..." }

Requires ownership of the secret. Omit walletAddress when signed in.

Auth

How MCP sessions authenticate.

Current user

Profile lookup and refresh.

Overview

MCP

JavaScript SDK

HTTP API

Verifier catalog

Standards

Where a saved key works

Add a key

Common questions

MCP tools

Create

List

Revoke

Auth

Current user

​Where a saved key works

​Add a key

​Common questions

​MCP tools

​Create

​List

​Revoke

Auth

Current user

Where a saved key works

Add a key

Common questions

MCP tools

Create

List

Revoke