Vault locked
Verify with your fingerprint or security key to view secrets & keys.
WebAuthn (FIDO2). Your laptop fingerprint (Touch ID / Windows Hello) and a YubiKey both work — and you can enroll several. This is factor 3; a super-admin can require all of them.
PURE Vault
A registry of every secret — where it lives, when it was last rotated, and what breaks if it changes. The actual values are never stored here — only where to find them and how to rotate them.
Secrets & API keys
Values live in Supabase Edge Secrets, Netlify, or your OS keychain — PURE Vault tracks them, it doesn’t hold them. That’s deliberate: a registry can’t be breached for secrets it never stored.
Your security keys & devices
Enroll multiple authenticators so you’re never locked out: laptop fingerprint for daily use + a YubiKey kept safe as backup. Lose one, use another.
PURE Vault · secrets registry, never raw values · WebAuthn-gated ·