Get started
Secrets control plane · Elastic License 2.0

The control plane for your secrets.

Bella Baxter decides who gets which secret, for how long and under which identity. The values stay in the Vault, OpenBao, AWS, Azure or GCP you already run. Values from your own stores are not kept in Bella's database.

Get started See the architecture
No values from your stores in Bella's database Self-host with one docker compose
bella
$ bella context init myapp dev
✓ Created .bella — context set to myapp/dev

$ bella run -- npm start
✓ Loaded 2 secret(s) from Bella

> myapp@1.0.0 start
> node index.js

myapp started with 2 secrets: DUMMY_API_KEY, DUMMY_DB_URL
Architecture

Control plane and data plane

workload → CLI/SDK → Bella (control plane) → your provider (data plane)

Who asks

01

Your application, your pipeline, your AI assistant or you at the CLI. Each one calls with its own identity, starting with bella run or the SDK for your language.

Bella Baxter · the control plane

02

Authenticates the caller, authorizes the request and proxies the value to and from your provider. Keeps connection settings and access rules. Caches values briefly, encrypted, and does not keep them in its database.

Your providers · the data plane

03

Vault, OpenBao, AWS, Azure or GCP, where your secrets already live.

Capabilities

What the control plane does today

Issues SSH certificates

Short-lived SSH certificates signed against your Vault. bella ssh sign replaces the keys you used to hand out.

Serves AI assistants

Claude, Copilot and Cursor read and write secrets through Bella's MCP server, under the same identity and rules as a person.

Data plane

Supported providers

  • Vault
  • OpenBao
  • AWS Secrets Manager
  • AWS Parameter Store
  • Azure Key Vault
  • Google Secret Manager
  • Vault Database
  • HTTP REST
Get started

Two commands and one file

bella context init writes a .bella file next to your code. It names the org, the project, the environment and the server, and holds no credentials, so it is safe to commit.

install
$ curl -sSfL https://github.com/Cosmic-Chimps/bella-baxter-cli/releases/latest/download/install-bella.sh | bash
$ bella login
.bella
org = "acme"
project = "myapp"
environment = "dev"
url = "https://api.bella-baxter.io"

Keep your secrets where they are. Put a control plane in front of them.

Get started