SynthSecret™
Sign InShare a Secret

DEVELOPER REFERENCE

Keep plaintext in the runtime.

A versioned API, signed requests, client encryption, structured errors and an agent-friendly JavaScript SDK.

Quickstart

import { SynthSecretClient,
  generateDevice } from './sdk/client.js';

const client = new SynthSecretClient({
  device: await generateDevice()
});
await client.enroll();
const exchange = await client.create(recipientId);
// Recipient: await recipient.accept(exchange.id)
await client.upload(exchange.id, localSecret);

Never pass secret values through an LLM transcript. Run encryption/decryption inside a trusted local tool. Pin the HTTPS issuer metadata in higher-assurance deployments.

Idempotency, pagination and errors

Create requests require an Idempotency-Key. Reusing the key with different inputs returns 409. List responses contain items and a next cursor. Errors have error.code, a safe message and a request ID; no payload echoes.

Limits

64 KiB text/JSON plaintext, low-risk classification for AIAL-1, default one-hour identities, a 30-second request-proof clock window, and tenant-controlled exchange TTL and retrieval counts. Rate limits return HTTP 429. API request bodies are capped at 140 KB.

OpenAPI explorer

Events

Secret Vertex and Syn receive routing metadata and status only. Webhook subscriptions require a tenant-approved destination and are not implicitly enabled. Never attach plaintext or ciphertext to model-visible tool results.

Testing

Use two disposable runtimes and synthetic fixture values. The repository test suite exercises wrong-recipient access, expiration, replay, tampering, revocation, race-safe retrieval and tenant separation.

Read the guides