Zentra

Desktop vault for API keys and secrets — documentation for developers.

ElectronReactTypeScriptSecurityDesktop

Architecture Overview

Zentra uses Electron with a strict security-first architecture. The main process handles all cryptographic operations, database access, and system integrations. The renderer process runs a React UI with sandboxed context.

architecture

React UI ←→ Electron IPC ←→ Main Process
                               ├── Crypto (Argon2id + AES-256-GCM)
                               ├── SQLite (sql.js + Drizzle)
                               ├── API Tester (Axios)
                               ├── Key Validation
                               ├── GitHub Secret Scanner
                               └── Google Calendar Sync

IPC API

All communication between the renderer and main process goes through the window.vaultIPC bridge. The following operations are exposed:

Vault Management

init(password)Create a new vault with the given master password

unlock(password)Unlock existing vault with master password

lock()Lock the vault and clear encryption key from memory

isInitialized()Check if a vault has been created

getUnlockStatus()Get failed attempts, lockout state, remaining attempts

Secrets CRUD

getProjects()List all projects

createProject(name, color)Create a new project

updateProject(id, data)Update project properties

deleteProject(id)Delete a project and its secrets

getSecrets(projectId)List secrets in a project

getSecret(id)Get a single secret by ID

createSecret(data)Create a new secret

updateSecret(id, data)Update secret properties

deleteSecret(id)Delete a secret

revealSecret(id)Decrypt and return secret value

Integrations

validateKey(secretId)Validate an API key against known patterns

batchValidateKeys(projectId)Validate all keys in a project

scanGitHubSecrets(projectId)Scan GitHub repos for exposed secrets

testApiRequest(config)Test an API endpoint with stored credentials

googleAuth(clientId, clientSecret)Authenticate with Google Calendar

syncSecretToCalendar(secretId)Sync secret expiry to Google Calendar

Data Model

Secrets support the following types: api_key, bearer_token,jwt, oauth_client, username_password,ssh_key, database_url, environment_variable, webhook_secret, and custom.

Environments: development, staging, production, and all.

Security

Argon2id configuration: time cost = 3, memory cost = 65536 KiB, parallelism = 4. AES-256-GCM with random 96-bit nonce per secret. See the security policy for the full threat model.

Building from Source

bash

git clone https://github.com/vihanga-nimsara/Zentra.git
cd Zentra
npm install
npm run dev        # development
npm run build      # production build
npm run package    # packaged distributable