Comparison
Vault, Infisical, Doppler, 1Password: all of them store credentials properly, and all of them finish by putting one into a process's environment. That was fine when the process was your app. It reads differently when the process is an agent taking instructions off the internet.
Secrets management has two halves and the industry has only finished one of them.
Encryption at rest, access policy, rotation, versioning, per-environment scoping, audit of who fetched what. This half is mature. The products below are good at it and Sallyport does not try to beat them.
solved, competitively
Something fetches the credential and then holds it in memory, an environment variable, or a file. From that instant the secret's safety is whatever that process's safety is. Nobody checks the process. Nobody records the call.
wide open
For most of software history the second half did not matter much, because the process holding the key was code you wrote. A coding agent is not code you wrote. It reads a web page, follows what it says, and runs with your credentials while it does.
Checked July 2026. These products move quickly; if something here has gone out of date, tell us and we will correct it.
the real incumbent
This is what you are running today
Zero setup, works with everything, and every tool on your machine already reads it. It is not a bad tool. It is the absence of one, and that is why it wins by default.
Any process running as you can read the file: the agent, its child processes, and whatever npm installed this morning. The TanStack, Shai-Hulud, and Nx incidents all worked exactly this way.
the reference implementation
Source of truth, not the last mile
Dynamic secrets with real leases and revocation, identity-based policy across a fleet, a serious audit device, and integrations for practically everything. If you run infrastructure at team scale, this is what you grow into. OpenBao is the fork to look at if the license change is your objection.
vault read finishes with the secret in a variable on a laptop. The lease is short; the copy sitting in the agent's environment is not leased at all. Vault has no view of which local process asked or what it did next.
the closest neighbor
Same instinct, different bet
An open-source platform with genuinely good DX, per-environment secrets, and a Kubernetes operator. Their Agent Vault is the nearest thing to Sallyport in the market: an HTTP forward proxy that substitutes credentials into the request so the child process never holds them.
It terminates TLS with its own CA, which is a real deployment cost and a real risk surface. Approvals cover host and path configuration rather than individual calls, a child can sidestep proxy variables unless the network forces the route, and the version we reviewed had no SSH.
the sync layer
Great sync, not a gate
Excellent at getting the right secrets to the right service across environments, branches, and CI. doppler run -- is clean and the team model is well thought out.
doppler run injects into the child process's environment. When the child is your service that is correct behavior. When the child is a coding agent, it is the whole problem.
the one you already have
One step short, on the HTTP side
Secret references keep plaintext out of your dotfiles, biometric unlock is fast enough to actually use, and the SSH agent shows a proper approval prompt naming the process that asked. That prompt is the right idea, and it is the closest mainstream experience to what an agent gate should feel like.
op run resolves those references into the child's environment, so the HTTP side has no equivalent of the SSH prompt. The gate exists for signing and stops there.
the last mile only
Built for one job
For HTTP and SSH the agent never receives the credential. It asks for an action, Sallyport attaches the key inside the app, makes the call, and returns the response. One approval per agent run, or one per call for keys you flag, each card showing the caller's code-signing authority. Everything lands in an encrypted, hash-chained journal.
One Mac, Apple Silicon, macOS 14 or newer. There is no team sync, no CI integration, no rotation, and nothing for Kubernetes, Linux, or Windows. It is not a secrets platform and it will not become your source of truth.
Most of these are not competitors. They solve adjacent problems and a lot of setups want two of them.
A team, a fleet, dynamic database credentials, an auditor
Vault or OpenBao
Nothing else in this list does leases, revocation, and fleet-wide policy properly. Not us, and not soon.
Secrets synced across environments and CI
Doppler or Infisical
This is their core competence and both do it well. Choose on pricing and on whether you want to self-host.
Plaintext out of your dotfiles on your own machine
1Password
You probably have it already, and secret references plus biometric unlock cover the everyday case.
A coding agent on your Mac with production access
Sallyport
This is the gap every tool above leaves open, because they all end by handing the credential to the process. It is the only thing we built for.
The realistic answer for most people is two tools: a source of truth for the team, and a gate at the point where an agent uses the key. Sallyport holds a copy of the few credentials your agent actually needs. It does not sync with anything and it is not trying to replace where those credentials come from.
Free download. Apple Silicon, macOS 14 or newer. No account, ever.
brew install --cask olegsotnikov/tap/sallyportmacOS 14+ · Apple Silicon