Skip to content
OpaqueVault Docs

Quickstart

import { Aside, Steps } from ‘@astrojs/starlight/components’;

Get from zero to zero-knowledge in under 5 minutes.

Prerequisites

Section titled “Prerequisites”

1. Install

Section titled “1. Install”

macOS (Homebrew):

Terminal window
brew install opaquevault-brew/tap/ov

Linux / macOS (curl):

Terminal window
curl -fsSL https://get.opaquevault.com | sh

Windows (PowerShell):

Terminal window
iwr -useb get.opaquevault.com/install.ps1 | iex

See installation for Scoop, WSL2, and what works natively on Windows today (the agent + MCP bridge are Linux/macOS only — Windows MCP users should use WSL2 for now).

Verify:

Terminal window
ov --version

2. Log in

Section titled “2. Log in”
Terminal window
ov auth login

You’ll be prompted for your email and master password. OpaqueVault derives your Key Encryption Key (KEK) from the password using Argon2id — the KEK never leaves your machine.

On first login, a default app is created automatically. You can create your own app in the next step.

3. Create an app and environment

Section titled “3. Create an app and environment”

Secrets in OpaqueVault are organized by app (a project namespace) and environment (production, staging, dev, etc.). DATABASE_URL in my-saas/production never collides with DATABASE_URL in another project or another env.

A new app starts with no environments, so the quickstart shape is to create both in one shot:

Terminal window
ov app create my-saas --with-env production
ov app use my-saas
ov env use production

ov app use / ov env use set the defaults for all subsequent commands; override per-command with --app / --env.

Not sure where you are? Run ov status any time:

Terminal window
ov status
API:      https://api.opaquevault.com
User:     [email protected]
App:      my-saas
Env:      production
Source:   config-default
Env OK:   yes

4. Store secrets

Section titled “4. Store secrets”
Terminal window
ov secret set DATABASE_URL
ov secret set STRIPE_SECRET_KEY
ov secret set OPENAI_API_KEY

OpaqueVault prompts for each value (input is hidden), encrypts it locally with a fresh DEK, and stores only the ciphertext on the server.

List what you’ve stored:

Terminal window
ov secret list

Output:

App: my-saas


NAME               UPDATED
DATABASE_URL       2026-04-10T14:32:11Z
STRIPE_SECRET_KEY  2026-04-10T09:01:44Z
OPENAI_API_KEY     2026-04-08T17:23:05Z

5. Connect to Claude Code

Section titled “5. Connect to Claude Code”

Add OpaqueVault as an MCP server in your Claude Code config (~/.claude/claude_desktop_config.json):

{
  "mcpServers": {
    "opaquevault": {
      "command": "ov",
      "args": ["mcp", "serve"]
    }
  }
}

Restart Claude Code. When ov mcp serve starts, it logs the active app to stderr so you can confirm it’s targeting the right context.

6. Ask Claude to use a secret

Section titled “6. Ask Claude to use a secret”

In Claude Code, you can now say:

“Run the database migrations using DATABASE_URL.”

Claude will call vault_run — the local bridge decrypts the secret, injects it as an env var into the subprocess, and returns only the exit code and output. The plaintext value never appears in Claude’s context window. Not once.

What’s running

Section titled “What’s running”
Claude Code  ──MCP/stdio──▶  ov mcp serve  ──HTTPS+PQC──▶  api.opaquevault.com
(never sees                   (decrypts                      (ciphertext only,
 plaintext)                    locally)                       no decrypt endpoint)

The interceptor in ov mcp serve is active by default. If a raw secret accidentally enters the MCP channel — a pasted API key, a token in a stack trace — it’s blocked before Claude sees it and logged to your audit trail.

Next steps

Section titled “Next steps”