The desktop app

The Veil Keys desktop app is the zero-knowledge side of the product. Your encryption keys are derived on your device from a master password and a Secret Key; the server only ever stores ciphertext and can’t decrypt anything. A small local bridge lets your AI agent use those secrets without ever seeing a value.

Use the desktop app when you want the strongest guarantee — mathematically, our servers can’t read your secrets — and for team sharing that stays end-to-end encrypted. Download it from veilkeys.com/download (macOS, Windows, Linux). The tour below recreates every screen.

1. Create your vault

On first launch you set a master password. From it (plus a freshly generated Secret Key) the app derives your vault key locally — nothing secret is sent anywhere.

1

Master password

Stretched with Argon2id on this device into your vault key. Choose something strong — it never leaves the machine.

2

On-device derivation

Keys are derived locally; the server receives only a non-secret salt + verifier, never the password or key.

3

Create vault

Generates your keypair and a one-time Secret Key, then shows your Recovery Kit.

2. Save your Recovery Kit

Your Secret Key is shown exactly once. With your master password it is the only way to unlock your vault — Veil cannot recover it. The app makes saving it deliberate: copy it, download the .txt, and confirm before continuing.

1

Secret Key

64 hex characters. Stored only by you — losing it (and your password) means the vault can't be opened, by anyone, including us.

2

Download Recovery Kit

Saves a plain-text file you can put in a password manager or offline backup.

3

Confirmation gate

You must tick “I've saved my Secret Key” before “Open my vault” unlocks — no accidental lockouts.

3. Your vault

Once unlocked you see your secrets. Each item carries the host it’s bound to and an optional method policy; items can be device-only (local) or synced (encrypted ciphertext on the server). This is also where you connect your agent.

1

Secret item

A stored credential with its bound host (e.g. api.stripe.com) and policy badge (e.g. GET, POST). The value is never shown unless you press Reveal.

2

Lock

Clears the in-memory keys and stops the bridge. Re-unlock with your password + Secret Key.

3

Add a secret

Opens the form in step 4.

4

Connect your AI agent

Live bridge status + the two steps to point Claude Code (or any MCP client) at your vault.

4. Add a secret

Adding a credential binds it to a host and (optionally) an HTTP-method policy. The plaintext is encrypted immediately and never displayed back.

1

API host

The domain this secret is bound to. Veil refuses to send it to any other host — domain binding is a hard boundary, not a label.

2

Allowed methods

Optional allow-list (e.g. GET) enforced before the secret is ever injected, so an agent can read but not write.

3

Secret value

Encrypted on save; from then on the app never shows it again — only Reveal (which you control) can.

5. Connect your AI agent

The Connect your AI agent panel (in the vault, above) shows the bridge status and the exact claude mcp add line. While the app is open and unlocked it runs a loopback, token-authed bridge on 127.0.0.1; the broker resolves secrets through it. Your agent calls list_services / call_api — it can use a secret but never reads the value, and the model never sees it.

6. Sync & teams

Sign in to a Veil account to sync across devices and share secrets with a team — end to end. The whole team flow lives here: switch the active workspace, create a team, invite teammates, accept an invite, re-share or rotate the shared key, and share a secret.

1

Active workspace

Switch between your Personal vault (sealed under your own key) and each team (sealed under a shared org key). “Share” targets whatever is active.

2

Create / Invite

Create a team, then invite teammates by email — you get a shareable link they paste into “Join a team” in their own desktop app.

3

Re-share key

Seals the existing shared key to teammates who joined after you created the team, so they can open already-shared secrets.

4

Rotate key

After removing someone: mints a new shared key, re-seals it to the remaining members, and re-encrypts every team secret so the removed member can't decrypt them.

5

Share with team

Seals a secret (with its host + policy) under the shared org key and syncs the ciphertext. Teammates open it on their own devices; the server never holds the key.

Next: see the web dashboard for the hosted side (zero-install, team management, billing, audit), or jump to the Quickstart.