Model keys

Sleeves call your model provider with your own API key. Sleevecast is built so that it never holds that key in the clear.

How a key is kept

1. On the Keys page you choose a provider, name the key and paste it.
2. Your browser encrypts the key separately for each of your Docks, using the Dock's public key. Only the encrypted copies leave the page.
3. Each Dock decrypts its own copy and gives the key to your sleeves inside your machine.

The page then shows, for each Dock, whether the key was verified with the provider there. Sleevecast keeps the encrypted copies, a fingerprint and the last four characters, nothing else.

Using a key in a spec

A spec names the key in conscience.apiKeySecretRef:

conscience:
  provider: anthropic
  model: claude-haiku-5-5
  apiKeySecretRef: anthropic-main

Rotating a key

Add the new key under the same name. Your browser seals it to every Dock again and the version number goes up; sleeves pick it up on their next start. Revoke the old key with your provider when the Docks show the new one as verified.

A new Dock

A Dock enrolled after you added a key has no copy of it yet. Open the Keys page: it shows the key as missing on that Dock and seals it again from your browser in one step.

A key only on one machine

You can also give a Dock a key that never goes through the console at all:

docker compose exec dock /app/dock keys set anthropic-key

A local key with the same name as an organization key takes precedence on that Dock.

Tokens for MCP servers

The same page keeps tokens for MCP servers: choose Token for an MCP server or tool and name it, for example github-token. It is sealed to your Docks like a model key; Sleevecast does not check it with anyone. A spec names it in a header's secretRef.