Evaluate Mint
Use this page before changing a consumer.
Mint fits when
Section titled “Mint fits when”Mint fits a local OMP path that requests a credentialed vendor effect.
The path must expose a destination or protocol boundary that Mint can bind.
The caller must accept a placeholder instead of a raw credential.
A custody backend must hold the real value.
An external system must own semantic authority decisions.
Mint does not fit when
Section titled “Mint does not fit when”Mint is not a vault.
It does not provide a general secret browser, export, checkout, or retrieval API.
Mint is not an authority engine.
It does not decide permissions, approvals, delegation, spend, or action appropriateness.
Mint is not a UI.
Mint is not an SDK.
Mint is not a general protocol broker.
A protocol path needs a concrete observed consumer and a non-disclosing boundary.
A child process that needs a raw credential remains unsupported.
Do not weaken containment for compatibility.
Current capability
Section titled “Current capability”The HTTP egress credential proxy is the default execution mode.
One typed action, firecrawl.interact_prompt, is implemented.
The deployed policy grants this typed action to one operator-scoped identity.
The generic interact proxy route remains denied.
Mint currently supports Keychain, environment, and systemd credential-directory stores.
Mint has no dynamic-credential source.
Aliases use the flat secret://<service>/<name> form.
Production authentication uses tailnet peer identity.
Loopback development uses a shared-secret capability.
The CLI exposes serve, doctor, policy, audit, alias, capability, adoption, release, and local-cutover commands.
Prerequisites
Section titled “Prerequisites”Before onboarding, identify the complete consumer launch path.
Confirm that the consumer can send a Mint placeholder.
Confirm that policy can bind its workload, destination, method, path, and alias.
Choose a custody backend that the consumer cannot inspect.
Prepare a synthetic receiver or vendor-side receipt.
Use an external authority system for semantic approvals.
Run the Quickstart before a real consumer migration.
Alternatives
Section titled “Alternatives”Use a custody system when you only need secret storage.
Use an authority or execution system when you need approvals or semantic policy.
Use OS identity or stronger isolation when a child must use non-HTTP credentials.
Keep provider-native OAuth tokens in their native store.
Inventory native OAuth as an exception.