Seeing a ghost key again

Requests are checked against a fingerprint (hash) of each ghost key. Vallkey also keeps an encrypted copy, sealed like the real key, so an admin who lost a ghost key can see it again under Connect → Your ghost key.

• Only admins and the owner, and only in the dashboard: never through the API, the CLI or AI agents, so a leaked API token cannot read ghost keys.
• Each view asks to confirm it's you (passkey, authenticator or email code), shows the key for 30 seconds, is written to the audit log and sent to your team as an alert.
• At most 10 views an hour per person.
• A ghost key found in public is not shown again; rotate it. After a rotation, only the new ghost key can be shown.
• Keys made before October 2026 have no copy: rotate one to get a ghost key you can see again.

Prefer shown once? The owner can turn this off under Settings → Security. Every stored copy is destroyed at once, and ghost keys are then shown only when they are made, as before. Apps keep working either way.