Products
Seren Passwords
Seren Passwords lets you give an employee access to a specific credential without placing the secret in a prompt, script, or shared configuration file. You choose what to share, access can require your approval, and every use is recorded. Seren stores encrypted data and cannot read the credential itself.
Trust model
The server never sees plaintext
Credentials are encrypted before they leave your device. When you share one, access is limited to the person or employee you selected and only that identity can unlock it. Seren keeps the encrypted item and the access record, but not the information needed to read the secret.
passwords.serendb.comA useful distinction
Passwords and Seren API keys
A Seren API key signs an application, script, or SDK into Seren. Seren Passwords stores credentials an employee may need for another service, such as a source control, alerting, or customer support account. Keep the application's Seren API key in its normal secure environment, and use Seren Passwords when an employee needs carefully controlled access to an outside account.
API keys are delegated capabilities rather than replacements for a signed-in user. Creating, listing, and revoking them requires a signed-in user session; an API key cannot administer other API keys. Browser sign-in obtains the short-lived user access token used for those requests, and clients can refresh that session without repeating the full sign-in flow for every operation.
Cloud employees are different: Seren creates a limited identity for each employee automatically. Never store your personal Seren API key in Passwords for an employee and never paste it into a skill. The employee uses its managed identity for Seren services, while Passwords remains the place for specific outside credentials you deliberately grant.
Controlled access
Give an agent access
When an agent needs a credential, Seren Passwords sends you a confirmation link. You open it in your browser, pick exactly which vaults the agent may use, and choose whether it gets read or write access. Nothing is granted until you confirm, and the agent only ever reaches the vaults you selected.
Vault contents stay end-to-end encrypted. Your browser unlocks the vault key locally and re-wraps it for the agent, so Seren stores and forwards encrypted material it cannot read. The credential itself is never written into the conversation. The confirmation link is a one-time approval link and does appear in the agent transcript, so treat it like any other sign-in link: whoever opens it sees only the agent's name and what it is asking for, and can approve only vaults they already administer.
You can revoke a grant at any time. The agent loses access on its next request, and your audit log records every read it made.
For developers
Integrate protected credential access
Applications can create vaults, share selected items, request approval, and review access history. An application or employee that has not been granted access cannot read the item.