## RHA Provider Vault

unsealing…

🔒

## Unlock Vault

Enter your vault password to access your provider keys.

🔐

## Create Vault

Choose a strong password. This encrypts all stored API keys with AES-256-GCM. There is no recovery — do not lose this password.

No providers yet. Add one below.
Preset
↗ keys
Name
Type
Base URL
Model override (blank = auto-detect)
API Key
⬡ No key stored
Assign role
Roles: Operator, Operator 2, Supervisor. Solo = Operator only. 2 Operators engage work-stealing automatically.
RHA Runtime
Web: jobs run in this extension via the Run tab; nothing to install.

Run the full RHA pipeline right here — no local server. Uses your active OpenAI-compatible provider; the corpus comes from rha.software. Export is a real git repository (frozen IR + build history included).
Product prompt
Vanilla (single draw — no scaffolding, no repair)

Pipeline log
Last 50 operations. No prompt content or key material is logged.
No operations yet.

### 🔐 Encryption at rest

All provider configs and API keys are encrypted with `AES-256-GCM` before being written to `chrome.storage.local`. Chrome storage is isolated to this extension — no website can read it.

### 🔑 Key derivation

Your vault password is never stored. Instead, a 256-bit encryption key is derived using `PBKDF2` with `100 000` iterations and `SHA-256`. The derived key lives in service-worker memory only and is cleared on lock.

### 🚫 Keys never leave your machine

When activating a provider, your API key is sent only to your local RHA server at `localhost`. For direct LLM proxying, keys go only to the provider's own endpoint (e.g. `api.anthropic.com`). Your key never touches any third-party server.

### 🔒 Auto-lock

The vault locks automatically after `5 minutes` of inactivity. The in-memory derived key is wiped; the vault cannot be accessed until the password is re-entered.

### 🌐 Origin allowlist

Only pre-approved origins can send messages to this extension (defined in `externally_connectable`). Arbitrary websites cannot request your keys or proxy calls through this extension.

### 📋 Audit log

Every activation and LLM proxy operation is logged with a timestamp, provider name, and outcome. No prompt content or key material is ever written to the log.