Protect Your API Keys
in 5 Minutes

What H33-Key is

H33-Key is the secret-use layer. It lets your code use API keys, tokens, and signing material without keeping the raw secret in plaintext on your server. You encrypt a secret once, store the returned keyId instead of the secret, and decrypt to plaintext only at the moment of use. This is secret-use control — distinct from a password manager (which stores credentials for humans) and from a secrets vault (which manages the lifecycle of secrets at rest). H33-Key governs the moment a secret is used.

Use it when your service holds third-party keys (Stripe, cloud, LLM providers) and you want them off disk and out of environment variables, retrievable only through an authenticated, audited call. Use something else when: you need to compute over encrypted data without decrypting it → FHE Platform; you need a portable, independently-auditable proof that an operation happened → H33-74; you need to prove a fact without revealing it → ZK Platform.

Install the SDK

Zero dependencies. Works with Node.js 18+ or Python 3.8+.

npm install @h33/key

pip install h33-key

# No install needed — just use curl
# Get your API key at h33.ai/pricing

Initialize with your API key

Get your key at h33.ai/pricing — free tier includes 1,000 credits/month.

import { H33Key } from '@h33/key';

const h33 = new H33Key({ apiKey: 'h33_your_key_here' });

from h33_key import H33Key

client = H33Key(api_key='h33_your_key_here')

# Set your API key as an env var
export H33_API_KEY="h33_your_key_here"

Encrypt your secret

Store the keyId in your database instead of the raw key. The plaintext is now encrypted with Kyber-1024.

// Encrypt your Stripe secret key
const { keyId } = await h33.encrypt('sk_live_abc123', {
  label: 'stripe-production'
});

// Store keyId in your database
// keyId = "hk_a1b2c3d4e5f6..."
await db.update({ stripe_key_id: keyId });

# Encrypt your Stripe secret key
result = client.encrypt('sk_live_abc123', label='stripe-production')

# Store key_id in your database
# result['key_id'] = "hk_a1b2c3d4e5f6..."
db.update(stripe_key_id=result['key_id'])

curl -X POST https://h33.ai/api/v1/key/encrypt \
  -H "X-API-Key: $H33_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key_material":"sk_live_abc123","label":"stripe-production"}'

# Response:
# {"key_id":"hk_a1b2c3...","ciphertext":"AQ...","tier":"key-0","credits_used":3}

Decrypt at point of use

When your app needs the plaintext, decrypt it. The key is returned, used, then garbage collected.

// At runtime, decrypt to get the original key
const { keyMaterial } = await h33.decrypt(keyId);

// Use it directly
const stripe = new Stripe(keyMaterial);
// keyMaterial === "sk_live_abc123"

# At runtime, decrypt to get the original key
result = client.decrypt(key_id)

# Use it directly
stripe = Stripe(result['key_material'])
# result['key_material'] == "sk_live_abc123"

curl -X POST https://h33.ai/api/v1/key/decrypt \
  -H "X-API-Key: $H33_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key_id":"hk_a1b2c3d4e5f6..."}'

# Response:
# {"key_id":"hk_a1b2c3...","key_material":"sk_live_abc123","credits_used":3}

What does the H33-Key SDK do?

It encrypts a secret (Kyber-1024 + AES-256-GCM) and returns a keyId you store in place of the raw value. A later decrypt(keyId) call returns the plaintext at point of use. Every operation is logged to an audit trail.

What's the minimal call to get started?

Install (npm install @h33/key or pip install h33-key), initialize with your API key, then h33.encrypt('sk_live_...') to get a keyId and h33.decrypt(keyId) to retrieve it. The equivalent REST calls are POST /api/v1/key/encrypt and /decrypt.

What does it not do?

It does not compute over your secret while it stays encrypted (that is FHE), it does not produce a portable independent proof of an operation (that is H33-74), and it is not a browser password manager. It governs how a secret is used, not human credential storage.

How is it different from a secrets vault?

A vault manages secrets at rest and their lifecycle. H33-Key focuses on the use event: the plaintext exists only transiently in your process when you decrypt, and the raw value never has to sit on your server or in your environment. Higher tiers add HMAC-SHA3 integrity, envelope rotation, and threshold + Dilithium signing.

Where does the plaintext live after I decrypt?

In your process memory for the duration of use, then it is garbage collected like any local variable. H33-Key does not persist the decrypted plaintext; you re-decrypt from the stored keyId whenever you need it again.

Which tier should I pick?

Key-0 (Kyber encrypt/decrypt + audit log) covers basic secret protection. Move up when you need integrity verification (Key-1, HMAC-SHA3), rotation (Key-2, envelope rotation), or split-authority signing (Key-3, threshold + Dilithium). See the full SDK docs for the API surface.