Protect Your API Keys
in 5 Minutes

What H33-Key is

H33-Key is the secret-use layer. It lets your code use API keys, tokens, and signing material without keeping the raw secret in plaintext on your server. You encrypt a secret once, store the returned keyId instead of the secret, and decrypt to plaintext only at the moment of use. This is secret-use control — distinct from a password manager (which stores credentials for humans) and from a secrets vault (which manages the lifecycle of secrets at rest). H33-Key governs the moment a secret is used.

Use it when your service holds third-party keys (Stripe, cloud, LLM providers) and you want them off disk and out of environment variables, retrievable only through an authenticated, audited call. Use something else when: you need to compute over encrypted data without decrypting it → FHE Platform; you need a portable, independently-auditable proof that an operation happened → H33-74; you need to prove a fact without revealing it → ZK Platform.

Install the SDK

Zero dependencies. Works with Node.js 18+ or Python 3.8+.

# Nothing to install — reached through your authenticated H33 account
# Sign in at h33.ai/login

# Nothing to install — reached through your authenticated H33 account
# Sign in at h33.ai/login

# No install needed — just use curl
# Get your API key at h33.ai/pricing

Initialize with your API key

Get your key at h33.ai/pricing — free tier includes 1,000 credits/month.

import { H33Key } from '@h33/key';

const h33 = new H33Key({ apiKey: 'h33_your_key_here' });

from h33_key import H33Key

client = H33Key(api_key='h33_your_key_here')

# Set your API key as an env var
export H33_API_KEY="h33_your_key_here"

Encrypt your secret

Store the keyId in your database instead of the raw key. The plaintext is now encrypted with Kyber-1024.

// Encrypt your Stripe secret key
const { keyId } = await h33.encrypt('sk_live_abc123', {
  label: 'stripe-production'
});

// Store keyId in your database
// keyId = "hk_a1b2c3d4e5f6..."
await db.update({ stripe_key_id: keyId });

# Encrypt your Stripe secret key
result = client.encrypt('sk_live_abc123', label='stripe-production')

# Store key_id in your database
# result['key_id'] = "hk_a1b2c3d4e5f6..."
db.update(stripe_key_id=result['key_id'])

curl -X POST https://h33.ai/api/v1/key/encrypt \
  -H "X-API-Key: $H33_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key_material":"sk_live_abc123","label":"stripe-production"}'

# Response:
# {"key_id":"hk_a1b2c3...","ciphertext":"AQ...","tier":"key-0","credits_used":3}

Decrypt at point of use

When your app needs the plaintext, decrypt it. The key is returned, used, then garbage collected.

// At runtime, decrypt to get the original key
const { keyMaterial } = await h33.decrypt(keyId);

// Use it directly
const stripe = new Stripe(keyMaterial);
// keyMaterial === "sk_live_abc123"

# At runtime, decrypt to get the original key
result = client.decrypt(key_id)

# Use it directly
stripe = Stripe(result['key_material'])
# result['key_material'] == "sk_live_abc123"

curl -X POST https://h33.ai/api/v1/key/decrypt \
  -H "X-API-Key: $H33_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key_id":"hk_a1b2c3d4e5f6..."}'

# Response:
# {"key_id":"hk_a1b2c3...","key_material":"sk_live_abc123","credits_used":3}

What does the H33-Key SDK do?

It encrypts a secret (Kyber-1024 + AES-256-GCM) and returns a keyId you store in place of the raw value. A later decrypt(keyId) call returns the plaintext at point of use. Every operation is logged to an audit trail.

What's the minimal call to get started?

Sign in to H33, initialize with your API key, then h33.encrypt('sk_live_...') to get a keyId and h33.decrypt(keyId) to retrieve it. The equivalent REST calls are POST /api/v1/key/encrypt and /decrypt.

What does it not do?

It does not compute over your secret while it stays encrypted (that is FHE), it does not produce a portable independent proof of an operation (that is H33-74), and it is not a browser password manager. It governs how a secret is used, not human credential storage.

How is it different from a secrets vault?

A vault manages secrets at rest and their lifecycle. H33-Key focuses on the use event: the plaintext exists only transiently in your process when you decrypt, and the raw value never has to sit on your server or in your environment. Higher tiers add HMAC-SHA3 integrity, envelope rotation, and threshold + Dilithium signing.

Where does the plaintext live after I decrypt?

In your process memory for the duration of use, then it is garbage collected like any local variable. H33-Key does not persist the decrypted plaintext; you re-decrypt from the stored keyId whenever you need it again.

Which tier should I pick?

Key-0 (Kyber encrypt/decrypt + audit log) covers basic secret protection. Move up when you need integrity verification (Key-1, HMAC-SHA3), rotation (Key-2, envelope rotation), or split-authority signing (Key-3, threshold + Dilithium). See the full SDK docs for the API surface.