Platform features

Everything you need to store, rotate, and access secrets

One portal over four services. Each capability is a real boundary — storage, identity, and key management scale and rotate independently.

Secrets & Stashes

Secrets live in stashes — named, org-scoped containers with role-based access control. Each secret carries its own encryption key, wrapped by the KMS, so compromising one secret never exposes another.

AES-256-GCM envelope encryption
Per-secret DEKs wrapped by versioned KEKs
Blind-index name lookup (names never in URLs or logs)
Version history with per-rotation audit
Role-based read/write access per stash
Optional per-secret expiration with automatic cleanup

app.tryaker.com/stashes/platform

prod-database

v7 · rotated 2d ago

billing-mssql

v3 · rotated 9d ago

session-cache

expires in 6d

Actionsets

Secrets carry a targeting rule tree — each rule's action shapes the value at read time and handles revocation. Build custom actionsets or use the built-in pgsql actionset for ephemeral Postgres credentials.

execute — transform values per caller at fetch time
rotate — rotate underlying values without changing params
revoke — invalidate individual issued values on demand
Targeting rule trees (match → action, first-match-wins)
Request-param narrowing for scoped access

app.tryaker.com/stashes/platform/secrets/prod-database

Rule tree first match wins

role is contractor pgsql · read only

team is platform pgsql · narrow ttl

user.id is any pgsql · 24h

Redis cache wraps pgsql

key = pg:{user.id} cache · 5m

Auth & Identity

Multiple sign-in methods with a unified session model. Every user gets a personal org, and teams and roles provide fine-grained access control across stashes and secrets.

Email/password credentials with timing-safe verification
Google OAuth with one-click linking
Magic link sign-in (passwordless email)
Personal org provisioned on signup
Team and role membership per org
Programmatic credentials for bots and services

Resolved once, forwarded verbatim

The identity service maps a session to the caller's user, orgs, teams, and roles. Downstream requests carry that context — never re-asserted by the client.

Sessions that stay server-side

Only an argon2id hash of each session key is stored. Tokens travel over the authenticated service channel, never in URLs or browser-facing bodies.

Key Management

The KMS wraps every secret's encryption key under a versioned Key Encryption Key. Root keys are non-exportable by construction — wrapping and unwrapping happen inside the service boundary.

Versioned KEKs with ordered rotation
Non-exportable root key (wrapped at rest)
Admin-gated rotation with audit trail
Per-secret DEK rotation (re-wrap without re-encrypt)
Derived keys for HMAC and other purposes

Rotating without downtime

New writes pick up the latest KEK immediately; existing DEKs are re-wrapped in the background, then the old version is retired.

Audit per caller

Every wrap, unwrap, and rotation is attributed to the authenticated caller that requested it.

Programmatic Access

Use the REST API or the upcoming MCP endpoint to integrate Aker into your CI/CD pipelines, infrastructure automation, and AI workflows. Programmatic credentials carry their own session model.

REST API for all secret and stash operations
MCP endpoint (planned) for AI-native access
Programmatic credentials with bot/session distinction
Per-caller audit trail

fetch a scoped credential

$ curl -X POST $SECRETS/v1/stashes/$STASH/secrets/lookup \ -H "X-Aker-Session-Token: $TOKEN" \ -d '{"name":"prod-database","request":{"role":"contractor"}}' { "action": "pgsql", "value": "postgres://aker_7f3a:••••@db.internal:5432/analytics", "expiresAt": "2026-09-25T16:33:00Z" } $ curl -X POST $SECRETS/v1/stashes/$STASH/secrets/$ID/rotate { "version": 7, "rotatedAt": "2026-09-25T16:32:11Z" }