# Overview

Seal keeps your app's API keys and database passwords inside a hardware enclave. Your servers hold a blob instead, so a hacker who takes one over finds nothing worth stealing.

Source: https://seal.zone/docs

Your app needs keys: an OpenAI key, a Stripe key, a database password. Wherever you keep them, the app ends up holding them in memory. Anyone with a shell on the server can read them.

Seal moves the key into an enclave, a program running inside a hardware TEE that the server itself can't look into. Your app holds a blob instead. Try it, then give a hacker root:

## Start here

<Cards>
  <Card href="/docs/quickstart" kicker="10 minutes" title="Quickstart">
    Seal an OpenAI key and call the API through Seal.
  </Card>
  <Card href="/docs/concepts" kicker="5 minutes" title="Key ideas">
    Blobs, sessions, tenants and admins, in one page.
  </Card>
</Cards>

## How it works

1. You seal a key once, with the CLI. You get back a blob, a line of text starting with `seal1.`.
2. Your app opens a session on the blob and hands the client it already uses a local URL and a stand-in key.
3. The enclave checks who's asking, adds the real key on the way out, and masks it in the response.

```python
with seal.session(os.environ["OPENAI_API_BLOB"]) as s:
    client = OpenAI(base_url=s.url, api_key=s.key)
```

## What it protects

**Root on your server can**

- Use the key through the enclave, as your app, while they're in.

**Root can't**

- Take the key away.
- Send it anywhere but its destination.
- Keep access once you remove the grant.

[What an attacker gets](https://seal.zone/docs/threat-model) covers every case, Seal included.

## Browse the docs

<Cards>
  <Card href="/docs/sealing" kicker="How it works" title="Sealing and sessions">
    How a key becomes a blob, and how a request gets its key back.
  </Card>
  <Card href="/docs/threat-model" kicker="Security" title="Why you don't have to trust Seal">
    Attestation, signed changes, public releases and checked telemetry.
  </Card>
  <Card href="/docs/upstreams" kicker="Using Seal" title="APIs and databases">
    HTTPS APIs, Postgres and Redis, and what each allows.
  </Card>
  <Card href="/docs/cli" kicker="Reference" title="CLI, limits and errors">
    Every command, number and error code.
  </Card>
</Cards>