A2A Vault (PassBox)
Zero-knowledge secrets management. Store API keys, tokens, and credentials with client-side encryption. The server never sees plaintext values.
Quick Start
Store a secret:
CODEBLOCK0
Retrieve a secret:
CODEBLOCK1
Available Tools
Secret Operations
| Tool | Description |
|---|
| INLINECODE0 | Retrieve and decrypt a secret |
| INLINECODE1 |
Create or update a secret (encrypted before upload) |
|
passbox_list_secrets | List secret names (values not returned) |
|
passbox_delete_secret | Delete a secret |
|
passbox_rotate_secret | Trigger manual secret rotation |
Vault Management
| Tool | Description |
|---|
| INLINECODE5 | List all available vaults |
| INLINECODE6 |
List environments (dev, staging, prod) |
|
passbox_get_environment | Get all secrets in an environment |
.env Integration
| Tool | Description |
|---|
| INLINECODE8 | Compare local .env with vault secrets |
| INLINECODE9 |
Import .env file into vault |
Workflows
Set up project credentials
- 1.
passbox_list_vaults — see existing vaults - INLINECODE11 — store each credential
- INLINECODE12 — verify all keys are stored
Sync .env with vault
- 1. Read your local .env file
- INLINECODE13 — see what's different
- INLINECODE14 — push local secrets to vault
Environment promotion
- 1.
passbox_get_environment for "dev" - Review values
- INLINECODE16 for each key in "staging"
Credential injection
Use with a2a_secure_execute to automatically inject secrets:
CODEBLOCK2
The {{API_KEY}} placeholder is resolved from PassBox before execution.
Security Model
- - Client-side encryption: Values are encrypted before leaving your device
- Zero-knowledge: The server stores only ciphertext
- Environment isolation: dev/staging/prod secrets are fully separated
- Audit trail: All access is logged
- Secret rotation: Built-in rotation support with webhooks
A2A Vault (PassBox)
零知识密钥管理。通过客户端加密存储API密钥、令牌和凭证。服务器永远不会看到明文值。
快速开始
存储密钥：
使用 passboxsetsecret，参数为 vault my-project，key API_KEY，value sk-abc123
检索密钥：
使用 passboxgetsecret，参数为 vault my-project，key API_KEY
可用工具
密钥操作
| 工具 | 描述 |
|---|
| passboxgetsecret | 检索并解密密钥 |
| passboxsetsecret |
创建或更新密钥（上传前加密） |
| passbox
listsecrets | 列出密钥名称（不返回值） |
| passbox
deletesecret | 删除密钥 |
| passbox
rotatesecret | 触发手动密钥轮换 |
保管库管理
| 工具 | 描述 |
|---|
| passboxlistvaults | 列出所有可用保管库 |
| passboxlistenvironments |
列出环境（开发、预发布、生产） |
| passbox
getenvironment | 获取环境中的所有密钥 |
.env 集成
| 工具 | 描述 |
|---|
| passboxdiffenv | 比较本地 .env 与保管库密钥 |
| passboximportenv |
将 .env 文件导入保管库 |
工作流程
设置项目凭证
- 1. passboxlistvaults — 查看现有保管库
- passboxsetsecret — 存储每个凭证
- passboxlistsecrets — 验证所有密钥已存储
同步 .env 与保管库
- 1. 读取本地 .env 文件
- passboxdiffenv — 查看差异
- passboximportenv — 将本地密钥推送到保管库
环境提升
- 1. 对dev环境使用 passboxgetenvironment
- 审查值
- 对staging环境中的每个键使用 passboxsetsecret
凭证注入
与 a2asecureexecute 配合使用，自动注入密钥：
使用 a2asecureexecute，参数为 toolId my-api-tool，input { apiKey: {{API_KEY}} }，vault my-project
在执行前，{{API_KEY}} 占位符会从 PassBox 解析。
安全模型
- - 客户端加密：值在离开设备前已加密
- 零知识：服务器仅存储密文
- 环境隔离：开发/预发布/生产环境的密钥完全隔离
- 审计追踪：所有访问均被记录
- 密钥轮换：内置支持带 webhook 的轮换功能
