Keep API keys out of Hermes’s config

Hermes asks MoltenRock for each key by name when it needs it. The value never lands in its config file, and you decide which keys it can ask for.

Download MoltenRock · Free See it in action

The short answer

To keep Hermes’s API keys out of its config, use MoltenRock as its secrets source. Hermes 0.21.1 and later asks MoltenRock for a key by name over a private pairing token; the key never sits in Hermes’s config, and the only thing MoltenRock writes there is its own block. Hermes can fetch only the keys listed on MoltenRock’s Hermes screen, and every fetch is logged.

The problem

Agent configs are where keys leak

Plaintext config
Keys in a config file are readable by anything that opens it.
Shared everywhere
Configs get copied between machines and into backups.
Invisible use
No record of which key Hermes used, or when.

How MoltenRock handles it

Fetched by name, logged every time

By name, on demand
Hermes asks for a key by name; MoltenRock answers over a private pairing token.
Only listed keys
Hermes can fetch only the keys on its MoltenRock screen.
Every fetch logged
On MoltenRock’s Activity screen.

How it works

Set it up

01
Update Hermes
Version 0.21.1 or later.
02
Pair in MoltenRock
On the Hermes screen; list the keys Hermes may fetch.
03
Start Hermes with MoltenRock unlocked
Hermes fetches its keys at start.

Straight answer

Worth knowing

Stays on your Mac

Your keys, sealed in the vault
Hermes’s config, without key values
The log of every fetch

Leaves your Mac

A listed key, to Hermes, when it fetches it
If Hermes re-saves its config and drops MoltenRock’s block, the Hermes screen offers Repair block
Nothing to a MoltenRock server

Questions

What people ask first

Hermes started without my keys. Why?

MoltenRock was locked or not running when Hermes started, or its block lost the pairing token. Unlock, click Repair block if asked, then restart Hermes.

Does MoltenRock touch the rest of my Hermes config?

No. It only ever rewrites its own block.

Can Hermes read my email through this?

No. Email is a separate lane; for email use MoltenMail.

What does it cost?

Free with 3 keys and 1 agent; Pro is unlimited from $9.99 a month.

Hermes, with its keys kept.

Free for Mac. No account, no cloud, no telemetry.