Set up your team
valetkey shares everything through the repo. Persona definitions are code in valetkey.config.ts. Secrets are in .valetkey/vault.age, encrypted to the team’s public keys. There is no server, no sync service, and no secret ever travels through chat or email.
What gets committed
Section titled “What gets committed”valetkey.config.ts, the personas and provider setup..valetkey/vault.age, the encrypted secrets..valetkey/recipients.txt, one public key per teammate.
What never gets committed: identity private keys (OS keychain or ~/.valetkey/identity), session artifacts (~/.valetkey/sessions/), and exported storage-state files (valetkey init gitignores playwright/.auth/).
Onboard a teammate
Section titled “Onboard a teammate”On the teammate’s machine, in the cloned repo:
npx valetkey identity createnpx valetkey identity showThey send you the printed public key. It starts with age1 and is safe to share anywhere. Then, on any machine that can already decrypt the vault:
valetkey team add "Ada" age1abc...This appends Ada to the recipients and re-encrypts the vault to everyone, including her. She pulls, runs valetkey doctor to confirm everything decrypts, and valetkey login admin works.
Remove a teammate
Section titled “Remove a teammate”valetkey team rm "Ada"This re-encrypts the vault without her key. She cannot decrypt anything committed after this point. She may still have copies of the old vault, so rotate the secrets it contained:
valetkey vault set DEV_USER_PASSWORDSee who has access
Section titled “See who has access”valetkey team listRecipients are also plainly readable in .valetkey/recipients.txt, which means access changes show up in code review like everything else.