AUROCRYPT

Support

Secure AI access, without credential sharing.

Start with the web app

Open Aurocrypt (formerly API Vault), sign in with Google, GitHub, or email, then follow the first-run guide. The normal flow is: connect a service or protected website → connect an AI → choose exactly which abilities that AI may use.

Connect ChatGPT

  1. In ChatGPT, open Settings → Apps (or your workspace's Workspace settings → Apps) and choose Create. Enable Developer mode if ChatGPT asks for it.
  2. Add https://vault.goldenphysics.org/mcp as the remote MCP endpoint.
  3. Choose OAuth authentication and let ChatGPT scan the available tools.
  4. Sign in to Aurocrypt when the authorization window opens, review the requested access, and approve it.
  5. Back in Aurocrypt → AI Access, choose exactly which of your connected services, signed-in websites, and vault credentials ChatGPT may use.

No provider password, OAuth token, browser cookie, or vault credential is pasted into ChatGPT. ChatGPT receives revocable Aurocrypt capabilities instead.

ChatGPT plan and workspace policy determine which custom-app actions are available. Full read/write MCP access currently has stricter plan and admin requirements than read-only access. Public one-click installation will use the ChatGPT app/plugin directory after review.

Connect a service

Use the Connections screen. Providers with configured one-tap OAuth show a normal Connect flow. Where a provider API is unavailable or not configured, use protected website sign-in. Raw API keys and personal access tokens are a compatibility fallback under the vault/advanced paths, not the normal onboarding route.

Whose Google, GitHub, or Supabase account is connected?

Yours. Aurocrypt may operate the provider registration that identifies Aurocrypt during OAuth, but you sign in to the provider and authorize your own account, organizations, projects, repositories, and other resources. Golden Physics accounts are never substituted for yours.

The authorization is bound to your Aurocrypt owner identity. Provider credentials stay encrypted behind the service boundary, and an AI receives only the capabilities you grant.

Something needs your approval

Consequential operations can be held for explicit approval. Open Home or Activity to review pending requests. Financial actions, security changes, destructive actions, and external communications remain separately controlled from broad provider access.

Stop AI access

Use the global pause control to stop AI authority without deleting your own connected accounts. You can also remove one service from one AI, revoke an AI identity, disconnect a provider, or revoke a protected browser profile independently.

Billing

On web, open Settings to start Stripe checkout or manage an existing Stripe-billed subscription. Android purchases are managed through Google Play. Team is not currently sold.

Security reports

Do not include API keys, bearer tokens, authorization codes, refresh tokens, passwords, MFA codes, worker keys, or screenshots containing credentials in a support report. Provide timestamps, the client/service name, HTTP status, correlation ID, and non-secret error text when available.

Contact

dtoupin@goldenphysics.org

Home · Privacy · Terms · Delete account