Comparison
Vault, Infisical, Doppler, 1Password: all of them store credentials properly, and all of them finish by putting one into a process's environment. That was fine when the process was your app. It reads differently when the process is an agent taking instructions off the internet.
Secrets management has two halves and the industry has only finished one of them.
Encryption at rest, access policy, rotation, versioning, per-environment scoping, audit of who fetched what. This half is mature. The products below are good at it and Sallyport does not try to beat them.
solved, competitively
Something fetches the credential and then holds it in memory, an environment variable, or a file. From that instant the secret's safety is whatever that process's safety is. Nobody checks the process. Nobody records the call.
wide open
For most of software history the second half did not matter much, because the process holding the key was code you wrote. A coding agent is not code you wrote. It reads a web page, follows what it says, and runs with your credentials while it does.
Checked July 2026. These products move fast, and so does this page.
the real incumbent
This is what you are running today
Zero setup, works with everything, and every tool on your machine already reads it. That is exactly why it wins by default, and exactly why it loses your keys.
Any process running as you can read the file: the agent, its child processes, and whatever npm installed this morning. The TanStack, Shai-Hulud, and Nx incidents all worked exactly this way.
the reference implementation
Owns the source of truth
Dynamic secrets with real leases and revocation, identity-based policy across a fleet, a serious audit device, and integrations for practically everything. If you run infrastructure at team scale, this is what you grow into. OpenBao is the fork to look at if the license change is your objection.
vault read finishes with the secret in a variable on a laptop. The lease is short; the copy sitting in the agent's environment is not leased at all. Vault has no view of which local process asked or what it did next.
the closest neighbor
Same instinct, different bet
An open-source platform with genuinely good DX, per-environment secrets, and a Kubernetes operator. Their Agent Vault is the nearest thing to Sallyport in the market: an HTTP forward proxy that substitutes credentials into the request so the child process never holds them.
It terminates TLS with its own CA, which is a real deployment cost and a real risk surface. Approvals cover host and path configuration while individual calls go through unattended, a child can sidestep proxy variables unless the network forces the route, and the version we reviewed had no SSH.
the sync layer
Best in class at sync
Excellent at getting the right secrets to the right service across environments, branches, and CI. doppler run -- is clean and the team model is well thought out.
doppler run injects into the child process's environment. When the child is your service that is correct behavior. When the child is a coding agent, it is the whole problem.
the one you already have
One step short, on the HTTP side
Secret references keep plaintext out of your dotfiles, biometric unlock is fast enough to actually use, and the SSH agent shows a proper approval prompt naming the process that asked. That prompt is the right idea, and it is the closest mainstream experience to what an agent gate should feel like.
op run resolves those references into the child's environment, so the HTTP side has no equivalent of the SSH prompt. The gate exists for signing and stops there.
the last mile only
Built for one job
For HTTP and SSH the agent never receives the credential. It asks for an action, Sallyport attaches the key inside the app, makes the call, and returns the response. One approval per agent run, or one per call for keys you flag, each card showing the caller's code-signing authority. Everything lands in an encrypted, hash-chained journal.
One Mac, Apple Silicon, macOS 14 or newer. Sallyport does one job and leaves team sync, CI, rotation, and Kubernetes to the platform you already run.
Most of these solve a different problem, and plenty of setups happily run two.
A team, a fleet, dynamic database credentials, an auditor
Vault or OpenBao
Nothing else in this list does leases, revocation, and fleet-wide policy properly. Not us, and not soon.
Secrets synced across environments and CI
Doppler or Infisical
This is their core competence and both do it well. Choose on pricing and on whether you want to self-host.
Plaintext out of your dotfiles on your own machine
1Password
You probably have it already, and secret references plus biometric unlock cover the everyday case.
A coding agent on your Mac with production access
Sallyport
This is the gap every tool above leaves open, because they all end by handing the credential to the process. It is the only thing we built for.
For most people the answer is two tools: a source of truth for the team, and a gate at the point where an agent spends the key. Sallyport holds a copy of the handful of credentials your agent actually touches and leaves the rest of your stack exactly where it is.
Free download. Apple Silicon, macOS 14 or newer. No account, ever.
brew install --cask olegsotnikov/tap/sallyportmacOS 14+ · Apple Silicon