Zero-Knowledge Secrets Vault & SQLCipher

Military-Grade Secrets Management

Your credentials, OAuth tokens, API keys, and client certificates must never sit in plaintext YAML files. CAPost enforces Zero-Knowledge storage using highly optimized encryption.

Cryptographic Architecture:

• Key Derivation Function: Password-based symmetric keys are generated using the highly secure Argon2id algorithm.
• Database Encryption: Secret material is stored inside a local SQLCipher encrypted database (AES-256) on your workstation's disk.
• Context Injection: Inject encrypted values directly into QuickJS scripts using special URI syntax:

  // Pre-request script retrieving a secret from the vault
  let dbPassword = postman.getVaultSecret("DATABASE/PASSWORD");
  request.headers.update({ "X-DB-PASS": dbPassword });

Security Promise: The underlying SQLite file is fully encrypted with per-page keys. No plaintext credentials ever leave the local filesystem.