The web dashboard

The hosted dashboard at app.veilkeys.com is the zero-install side of Veil Keys. Sign up in a browser and you can add credentials, mint agent tokens, manage a team, and audit every use — your agents use secrets through the broker; they never read them.

Layout

The left sidebar is your map: Workspaces (folders of credentials, each with its own key), Organization (Members, Activity, Billing), and Account (Agents & Security, Profile). The main panel shows the selected view.

1

Workspaces

Each is an isolated folder of credentials with its own encryption key — e.g. Production, Staging. Access is granted per workspace.

2

Credential row

The service, its bound host, and the auth scheme. Status flips to “ready” the moment a value is encrypted at rest.

3

Add credential

Pick a service from the catalog (or Custom), set the scheme + base URL, and paste the value — shown back never again.

4

Organization & Account

Team management and audit live under Organization; tokens and your profile under Account.

Agents & Security — tokens

This is where you mint the tokens your agents and CI use. An agent token drives the MCP broker; scope it to exactly the tools, HTTP methods, and workspace it needs. It’s shown once as veil_agent_….

1

Agent token

Authenticates an MCP client (Claude Code, Cursor, …) to the hosted broker. Last-used and revoke are one click away.

2

Scopes

Tools (list_services, call_api…), HTTP methods (e.g. GET only), and an optional workspace binding — least privilege by default.

3

Use, never read

A token can ask the broker to use a credential; it can never reveal a plaintext value or sign, and can only narrow access.

Switch a workspace’s trust mode

Every workspace is Hosted by default — maximum convenience, the server injects for you. Flip any workspace to Zero-knowledge (or back) with one switch. The card spells out exactly what each mode costs, and your existing secrets are copied to the new mode on-device — nothing is lost.

1

Current mode

A badge shows whether this workspace is Hosted (server can inject) or Zero-knowledge (your keys only). The default is Hosted.

2

What changes

Switching to ZK: the server can't read or inject these anymore, and agents must run the local broker. Switching to hosted: the server can read them at injection time — you're told plainly, both ways.

3

Lossless migration

Hosted→ZK seals each secret in your browser; ZK→hosted decrypts on-device then uploads. Anything that can't auto-map (SSH keys, multi-field) is reported, never dropped. Re-running is safe — it won't duplicate.

Vault (ZK) — manage secrets in your browser

When your account has zero-knowledge enabled (from the desktop app), a Vault (ZK) tab appears. You unlock it with your master password + Secret Key in the browser — the keys are derived on your device, held in the tab’s memory only, and never sent anywhere. From here you add, edit, reveal, and revoke secrets, exactly like the desktop — each one sealed in your browser before it ever reaches the server, which only ever stores ciphertext.

1

Unlock (in-browser)

Master password + Secret Key derive your keys locally — nothing secret leaves the tab. Wrong credentials simply fail to open anything (no oracle, no server check).

2

Add / edit

Create or update a secret right here — it's sealed in your browser (host + optional method policy) and only the ciphertext is uploaded. It syncs to your desktop instantly.

3

Reveal / revoke

Reveal is per-item and copy-only; the plaintext never persists. Delete revokes it everywhere; for teams, rotate the shared key so a removed member loses access.

4

Lock

Zeroes the in-memory keys. Closing or reloading the tab clears them too — there's no decrypted state at rest in the browser.

Members — team & seats

Invite teammates, set roles, and manage per-workspace access. Seats are tracked against your plan.

1

Members & roles

Owner / Admin / Member / Viewer. Roles gate who can manage credentials, invite people, or change billing.

2

Invite

Send an email invite (or share the link). Hosted-mode access is granted on accept.

3

Per-workspace access

Grant read / use / reveal / manage per workspace, so a contractor sees only Staging, never Production.

Activity — the audit trail

Every credential use and admin action is recorded, append-only. Agent calls, credential changes, invites, and CI usage all show up here.

1

Agent calls

Each broker call is logged with the target host + method — you see what your agents did, never a secret value.

2

Admin actions

Credential adds, invites, role changes, revocations — a tamper-evident history for compliance.

3

Append-only

Entries can't be edited or deleted from the UI; the trail is the source of truth for “who used what, when.”

Billing

Plans, seats, and invoices, handled by Paddle as Merchant of Record. Upgrade, add seats, or manage your subscription here.

1

Plan & seats

Free, Pro, or Team. Seat usage and limits are shown live; inviting beyond your seats prompts an upgrade.

2

Usage

Workspaces and credentials at a glance, against your plan's limits.

3

Manage plan

Opens Paddle's secure checkout/portal — Veil never stores card data.

See the full breakdown on the Plans & limits page, or tour the desktop app for the zero-knowledge side.