Import your .env file. HuGR absorbs every credential into an encrypted vault, replaces them with proxy keys, and handles authentication entirely on Cloudflare's edge. Your real keys never reach your machine.
This is what happens to your .env when you point HuGR at it.
When your application makes a request with a proxy key, HuGR Cloud resolves it, authenticates with the real credential on Cloudflare's edge, and returns the response. The real key never leaves the cloud infrastructure. Your machine only ever sees the proxy key and the cleaned response.
Every proxy key is cryptographically bound to your wallet session. If the wallet isn't active on your machine, the key is inert — it can't authenticate, it can't proxy, it can't do anything. A leaked proxy key is not a security incident. It's a string.
Point HuGR at any .env file. Every key is absorbed into the vault and replaced with a proxy key. One action, zero config.
Proxy keys are tied to your active session. No wallet running, no access. Leaked keys are inert by design.
Revoke or rotate any proxy key instantly. The old key stops working immediately. No downstream coordination needed.
Share a secret with a teammate or AI agent for a limited time. Access expires automatically. Full audit trail.
Proxy LLM requests and stream responses in real time. Use your OpenAI or Anthropic key without exposing it to any client.
The proxy strips your real credential from every upstream response — raw, URL-encoded, hex, and base64. Zero leakage.
Every proxy call, rotation, toggle, and grant is logged with timestamp and hashed IP. Retention from 7 to 365 days by tier.
Disable a key without deleting it. Re-enable when ready. Rename, label, and group secrets for fast access.
Each account gets a unique address (hugr_username). Use it to share secrets via grants or receive credentials from teammates.
AI agents operate the vault via Model Context Protocol. 24 tools, Claude Code bootstrap, and full API access under the same audit trail.
Secrets encrypted at rest with per-user keys derived from the server's master secret. Decrypted only on Cloudflare's edge for the upstream call.
Runs on Cloudflare Workers globally. No single server. No shell access. No /proc. The V8 isolate is destroyed after every request.
| Feature | Free | Budget — $9/mo | Pro — $29/mo |
|---|---|---|---|
| Vault secrets | 5 | 15 | Unlimited |
| Proxy requests / day | 200 | 2,000 | Unlimited |
| SSE streaming (LLMs) | — | Yes | Yes |
| Response redaction | Yes | Yes | Yes |
| Token rotation | Yes | Yes | Yes |
| Temporary grants | — | Yes | Yes |
| MCP integration | — | Yes | Yes |
| Audit log retention | 7 days | 30 days | 90 days |
| Custom domains | — | — | Yes |
Download HuGR Wallet. Import your secrets. Ship with confidence.