Personas
Define admin, free user, and org member once in a committed config file.
valetkey login admin signs your agent in as that user.
valetkey
Your coding agent works on the app you are building as a signed-in user. Passwords, secret keys, and magic links stay with you.
Why this exists
Section titled “Why this exists”Coding agents are good at building and testing your app, and terrible at logging into it. The usual workarounds either hand the agent a password from a .env file or leave it stuck at your sign-in page. valetkey mints real sessions from your app’s auth layer and gives the agent only a short-lived session artifact.
A valet key starts the car but opens neither the trunk nor the glovebox. Same idea.
valetkey login admin --export playwright/.auth/admin.jsonOne command, and your agent’s browser is signed in as the persona you picked.
Secrets stay encrypted
Provider secrets live in an age-encrypted vault committed to your repo. They decrypt only inside valetkey and never reach agent context.
Guardrails on by default
Sessions expire after 60 minutes, cookies pin to your dev origins, production origins and live keys are refused, and every mint lands in an audit log.
Works with your agent
An MCP server lets Claude Code, Codex, and Cursor sign themselves in, into a Chrome profile valetkey manages or a storage-state file they load.
Built for teams too
Section titled “Built for teams too”Persona definitions live in valetkey.config.ts and secrets live in .valetkey/vault.age, both committed. A teammate clones the repo, shares their public key, and their agent can log in as the same personas. Nobody pastes a secret into a chat.