> ## Documentation Index
> Fetch the complete documentation index at: https://docs.proofable.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Encrypted secrets

> Store, list, and revoke portable encrypted secrets through MCP.

Three public MCP tools manage **encrypted secrets** tied to your Proofable Profile. Values are sealed with AES-256-GCM and **never returned in plaintext** through MCP.

Sign in first with OAuth or a Profile access key ([Auth](./auth)). Use the signed-in profile context from **`proofable_context`** before create or revoke.

| Tool                          | Purpose                                              |
| ----------------------------- | ---------------------------------------------------- |
| **`proofable_secret_create`** | Store a named secret as an encrypted proof           |
| **`proofable_secret_list`**   | List secret metadata (alias, qHash, type). No values |
| **`proofable_secret_revoke`** | Revoke a secret proof by qHash                       |

When signed in, **omit `walletAddress`**. Secrets bind to your profile account from `proofable_context`.

## Create (`proofable_secret_create`)

```json theme={"dark"}
{
  "alias": "OPENAI_API_KEY",
  "secretType": "single",
  "content": "<your-secret-value>"
}
```

| Field           | Notes                                                                        |
| --------------- | ---------------------------------------------------------------------------- |
| `walletAddress` | Optional when signed in; must match the authenticated profile account if set |
| `alias`         | Letters, numbers, underscore; must start with a letter                       |
| `secretType`    | `single` (default) or `bundle` (JSON object string in `content`)             |
| `content`       | Plaintext input. Encrypted at rest; never echoed back via MCP                |

## List (`proofable_secret_list`)

```json theme={"dark"}
{
  "limit": 50,
  "offset": 0
}
```

Without Bearer auth, the tool returns an empty list and `authRequired: true`. It does not leak metadata.

## Revoke (`proofable_secret_revoke`)

```json theme={"dark"}
{
  "qHash": "..."
}
```

Requires authenticated ownership of the secret proof. Omit `walletAddress` when signed in.

## Security

* Never paste secret values into chat logs or public issues.
* Prefer OAuth or Profile keys in MCP config only. Do not use them in app browser bundles.
* Rotate or revoke through **`proofable_secret_revoke`** and re-create if a value is exposed.

<CardGroup cols={2}>
  <Card title="Auth" icon="lock" href="./auth">
    How MCP sessions authenticate.
  </Card>

  <Card title="Current user" icon="user" href="./context">
    Profile lookup and refresh.
  </Card>
</CardGroup>