Using QuantaSeal

Quick Start#

If you just want to see it work before reading the full guide:

npm install -g @quantaseal/cli
quantaseal config set api-key qsk_live_...   # from your dashboard, or see Step 1
quantaseal health                            # confirm you're connected
quantaseal encrypt --text "hello, quantum world" --out demo.enc.json
quantaseal decrypt --file demo.enc.json      # -> "hello, quantum world"

That's a real ML-KEM-768 + AES-256-GCM round trip. Everything after this section is the same idea, applied to credentials, integrations, and AI agents.

1 Create your account#

Two paths, depending on whether you want a UI or you're integrating programmatically from day one.

Path A - Web console (most people)

Go to app.quantaseal.io/register, sign up with your work email, verify it, and you're in a 14-day trial automatically. Generate your API key from Settings → API Keys once logged in - it's shown once, so save it immediately.

Path B - API-first (if you're scripting the whole setup)

curl -X POST https://api.quantaseal.io/api/v2/tenants/onboard \
  -H "Content-Type: application/json" \
  -d '{
    "organization_name": "Acme Corporation",
    "slug": "acme-corp",
    "admin_email": "admin@acme.com",
    "admin_name": "Jane Smith",
    "plan": "starter"
  }'

Returns your tenant_id and a live api_key in the same response - no email verification step needed for this path. Save the key now; it isn't shown again.

2 Install a client#

Pick whichever fits how you work - they all hit the same API.

For the CLI, set your key once and it's remembered:

quantaseal config set api-key qsk_live_your_key_here
quantaseal status
# QuantaSeal CLI v1.1.0
# API URL: https://api.quantaseal.io
# API Key: qsk_live_your...
# Config:  ~/.quantaseal/config.json

Or skip the config file entirely and use environment variables (better for CI):

export QUANTASEAL_API_KEY=qsk_live_your_key_here
export QUANTASEAL_API_URL=https://api.quantaseal.io

3 Seal your first credential#

QuantaVault is where API keys, database passwords, and OAuth tokens live - encrypted with your tenant's own ML-KEM-768 key, never in plaintext.

quantaseal vault seal --name "stripe-api-key" --type api_key --secret "sk_live_..." --ttl-days 1

List what's sealed, and unseal when you actually need the plaintext:

quantaseal vault list
quantaseal vault unseal <entry-id>
# {"key": "sk_live_..."}

4 Encrypt & decrypt data#

For protecting data directly - not just credentials in the vault.

quantaseal encrypt --text "customer record contents" --out record.enc.json
quantaseal decrypt --file record.enc.json
# customer record contents

The wire format is publicly documented at github.com/QuantaSeal/wire-format if you want to decrypt with a different conformant implementation instead of QuantaSeal itself.

5 Sign & verify data#

For tamper detection - proving data hasn't been altered, independent of who can read it.

quantaseal sign --text "contract terms v3" --out contract.sig.json
quantaseal verify --signature-file contract.sig.json
# ✅ Signature is valid

Verification needs four values (the signature, an HMAC, the public key, and the original data) - the signature bundle file from sign carries all of them, so you don't have to track each one manually.

6 Connect an integration#

This is what makes QuantaSeal a proxy, not just a crypto library - it sits in front of Salesforce, SAP, AWS, Postgres, and 40+ other systems.

Create integrations from app.quantaseal.io/integrations/new (the guided flow handles per-system credential fields). Manage them from the CLI once created:

quantaseal integrations list
quantaseal integrations test <integration-id>
# ✅ Connected (142ms) - Connection successful (HTTP 200)

Check quantaseal.io/integrations/status for which of the 40+ systems are production-verified today versus beta - it's kept honest on purpose.

7 Run the proxy#

Once an integration exists, route real operations through it via the REST API (no CLI command for this one yet - use the SDK or curl):

curl -X POST https://api.quantaseal.io/api/v2/proxy/outbound \
  -H "X-API-Key: $QUANTASEAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "integration_id": "<integration-id>",
    "operation": "query",
    "payload": { "object": "Account", "limit": 10 }
  }'

QuantaSeal unseals the underlying credential, makes the call, and returns an encrypted response envelope - the same hybrid format as Step 4.

8 Wire up your AI agent#

If you're building with Claude, GPT, or Copilot and want tool-calls that touch your systems to be quantum-safe.

npm install -g @quantaseal/mcp-server

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "quantaseal": {
      "command": "quantaseal-mcp",
      "env": { "QUANTASEAL_API_KEY": "qsk_live_your_key_here" }
    }
  }
}

Restart Claude Desktop and your agent gains direct tool access to vault operations, encrypt/decrypt/sign/verify, integration proxying, and compliance queries - all under the same per-tenant key isolation as everything else.

9 Check your compliance posture#

A live evidence summary, not a static PDF you have to remember to regenerate.

quantaseal compliance report --framework soc2
# Framework:    SOC2
# Score:        62/100
# Period:       90 days
# Generated:    2026-09-07T07:10:10Z
# Sample logs:  1 audit events included as evidence

Supported frameworks: soc2, iso27001, pci_dss, hipaa, gdpr, nist_csf, fedramp, apra, nist_800_53. For the full PDF (executive summary, control-by-control evidence, sample audit logs), use app.quantaseal.io/compliance - PDF download isn't in the CLI yet.

10 Rotate & manage credentials#

Given the 24-hour TTL from Step 3, rotation is part of normal operation, not an edge case.

quantaseal vault rotate <entry-id>
# ✅ Rotated vault entry ...
#    New entry ID: ...
#    Old entry ID is now retired: ...

Rotation re-encrypts the existing secret under a fresh key - it doesn't change the secret's value. To replace the value itself, seal a new entry and delete the old one:

quantaseal vault delete <old-entry-id>

11 Invite your team#

Role-based access (viewer / editor / admin / owner) is managed from the console, not the CLI. Go to app.quantaseal.io/settings → Team, and invite by email. Each role gates what a teammate can do - for example, only admin+ can rotate keys or view unsealed credentials.

12 Monitor & scale#

Watch usage, then upgrade when the numbers say to.

quantaseal audit logs --hours 24
quantaseal audit verify-chain --limit 100

The audit log is a SHA3-256 hash chain, not a plain table - verify-chain proves nothing has been altered after the fact, which matters if you're ever asked to produce it as evidence.

When you outgrow your current plan's integration or transaction limits, upgrade from app.quantaseal.io/billing - the change applies immediately, prorated.

Command Reference#

Troubleshooting#

Getting Help#

Email support@quantaseal.io directly - for an early-stage product, the founder reads and answers these personally, which is often faster than a ticket queue. Include the command you ran and the exact error message; that's usually enough to diagnose immediately.