On-chain secrets. Real API calls.

Every other chain pretends the outside world doesn't exist.

A smart contract that wants to do anything useful needs to call an API. To call an API, you need a credential. Most chains punt: trust an oracle, run an off-chain bot, paste the credential into Vercel and hope nobody asks too many questions. The chain stops being a chain. It becomes a billboard for events that the off-chain part of your system mostly ignores.

Asentum Vault + Workers fixes this. The credential is on chain, encrypted. The authorization rules are smart contract code. The actual call happens in a Worker process that the chain authenticates by its registered public key. Every fire, every recipient, every response hash, all publicly verifiable.

Or skip the SDK. Create the secret from a UI.

Open the IDE at ide.asentum.com/vault, connect your wallet, hit + NEW SECRET at the top of the Workers pane. Form has four fields: name, plaintext, Worker, authorized contracts. Encryption happens in the browser, the put tx is signed by your extension or Telegram wallet, and you get the sid back as a copy-friendly value plus a drop-in code snippet for your contract.

Prefer code? Two snippets and you're live.

CI pipelines, secret rotation scripts, automated provisioning — anywhere a UI would be friction, the SDK does the same job.

import { VaultClient } from '@asentum/vault-sdk';

const vault = new VaultClient({
  rpc: 'https://testnet.asentum.com',
  vaultAddress: '0x0000000000000000000000000000000000000008',
  registryAddress: '0x0000000000000000000000000000000000000009',
  keypair: myWallet,
});

const { sid } = await vault.put('slack-webhook', {
  plaintext:           process.env.SLACK_WEBHOOK_URL,
  workerId:            'asentum-default',
  authorizedContracts: ['0xMyHRContract'],
});

// In your contract. Fires once a day from native cron.
function notifyBirthdays() {
  const sid = storage.get('slack-sid');

  for (const employee of getBirthdaysToday()) {
    const jobId = E.deriveJobId(sid, this.address, chain.blockNumber, employee.id);

    E.call(VAULT, 'requestDecryption', [sid, jobId, JSON.stringify({
      url:       'https://hooks.slack.com/services/...',
      method:    'POST',
      secretAs:  { kind: 'body-key', key: 'webhook_token' },
      body:      { text: 'Happy birthday ' + employee.name + '!' },
    })]);
  }
}

The category we just unlocked.

Eight dapp shapes that used to require an off-chain bot + a credentials manager + a cron service. Now they live in a contract.

What you trust. What you gain.

You trust the Worker operator with reading the plaintext of any secret encrypted to that Worker. That's the same trust you place in Vercel today when you paste a Stripe key into their dashboard. There's no way around it on a transparent chain: if a contract can decrypt a secret autonomously, then whoever runs the decryption process can read it.

What you gain over the Vercel model: WHO can fire the call (authorized contracts), WHEN it can fire (cron on chain), WHAT call gets made (your contract code), THAT it fired (events on chain), WHICH Worker did it (signed tx with registered pubkey), and the POLICY the Worker is operating under (policy hash committed at registration). All enforced by code anyone can read.

And if you want to eliminate the Worker-as-trusted-party concern entirely, run your own. npm install @asentum/workers, five minutes of setup, you own the keys. Future protocol versions add threshold decryption across multiple Workers to retire the single-point-of-trust entirely.