tuckcap

Credentials, under your control.

Give access.
Keep the secrets.

Tuckcap lets people, tools, and agents use your credentials without receiving them. Set what each caller can do, for how long, and when you need to approve.

Read the guide How it works

Run your own server. Keep your vaults portable.

Architecture

Permission sits between
the caller and the credential.

Your Tuckcap server checks each request, applies your rules, and uses the credential on the caller’s behalf.

Explore operations

Tool or agent

Requests an operation

Scoped access

Your Tuckcap server

Checks permissions · uses credentials

Authenticated request

Upstream service

Receives the API call

The caller receives the result, not the credential.

Bounded permissions

Limit access by operation, lifetime, and use count. Require approval when a request needs your attention.

Delegation with limits

Let a caller pass narrower access to others. The parent’s permissions and budgets still apply.

Portable vaults

Credentials, permissions, and audit history live together in encrypted storage. Keep it locally, in S3, or with managed storage.

In practice

One endpoint.
Three requests.
One hour.

A grant for an existing GitHub operation. The tool uses its own Tuckcap token; your GitHub token stays in the vault.

Follow the walkthrough

Owner’s shell

tuckcap grant <principal-id> github-api \
  --allow 'GET /user' \
  --uses 3 \
  --ttl 1h

Tool’s shell

curl "$TUCKCAP_URL/p/github-api/user" \
  -H "Authorization: Bearer $TUCKCAP_TOKEN"

Getting started

Run it your way.

Use your own server and storage. Managed storage is available if you’d rather skip setting up a bucket.

Start with Tuckcap

Install the CLI and connect to your Tuckcap server.

Download installer Documentation

Optional managed storage

A place for encrypted vaults. You still run the server.

Set up storage