Encrypted secrets

Three public MCP tools manage encrypted secrets tied to your Proofable Profile. Values are sealed with AES-256-GCM and never returned in plaintext through MCP. Sign in first with OAuth or a server key (Auth). Use the signed-in profile context from proofable_context before create or revoke.

Tool	Purpose
`proofable_secret_create`	Store a named secret as an encrypted proof
`proofable_secret_list`	List secret metadata (alias, qHash, type). No values
`proofable_secret_revoke`	Revoke a secret proof by qHash

When signed in, omit walletAddress. Secrets bind to your profile account from proofable_context.

Create (`proofable_secret_create`)

{
  "alias": "OPENAI_API_KEY",
  "secretType": "single",
  "content": "<your-secret-value>"
}

Field	Notes
`walletAddress`	Optional when signed in; must match the authenticated profile account if set
`alias`	Letters, numbers, underscore; must start with a letter
`secretType`	`single` (default) or `bundle` (JSON object string in `content`)
`content`	Secret value stored in Vault. Encrypted at rest; never echoed back via MCP

List (`proofable_secret_list`)

{
  "limit": 50,
  "offset": 0
}

Without Bearer auth, the tool returns an empty list and authRequired: true. It does not leak metadata.

Revoke (`proofable_secret_revoke`)

{
  "qHash": "..."
}

Requires authenticated ownership of the secret proof. Omit walletAddress when signed in.

Security

Store secrets only through proofable_secret_create. Confirm the stored name and proof ID. Never print the value in chat.
Prefer OAuth or Profile keys in MCP config only. Do not use them in app browser bundles.
Rotate or revoke through proofable_secret_revoke and re-create if a value is exposed.

Auth

How MCP sessions authenticate.

Current user

Profile lookup and refresh.

Overview

MCP

JavaScript SDK

HTTP API

Verifier catalog

Standards

Create (`proofable_secret_create`)

List (`proofable_secret_list`)

Revoke (`proofable_secret_revoke`)

Security

Auth

Current user

​Create (proofable_secret_create)

​List (proofable_secret_list)

​Revoke (proofable_secret_revoke)

​Security

Auth

Current user

Create (`proofable_secret_create`)

List (`proofable_secret_list`)

Revoke (`proofable_secret_revoke`)

Security