Doppler for AI agents

Doppler is a secrets management platform that lets development teams organize environment variables and sync them across projects and infrastructure. Connect it once through Arc0, and your agent, or Claude, ChatGPT and Cursor, can use it through one MCP endpoint, limited to what each user approved.

Connect Doppler See the 62 actions ↓

Developer toolsAPI keyMCP + RESTdoppler.com

AUDIT LOG · DOPPLERPOLICY: acme-support

09:41:07 · claude · u_8f2read

doppler.list_users

List Workplace Users✓ allowed · 212ms

09:41:08 · claude · u_8f2read

doppler.get_webhook

Get Webhook✓ allowed · 164ms

09:41:09 · claude · u_8f2write

doppler.create_plain

Create Plain Text Share Link✓ approved · approved by user

09:41:12 · claude · u_8f2destructive

doppler.delete_webhook

Delete Webhook✕ blocked · policy: deny

EVERY DOPPLER CALL, ON THE RECORD

01 · USE CASES

What agents do in Doppler.

Check a config's activity log

Read the activity log for a config to see who changed a secret and when.

Create a share link for a secret

Create an encrypted share link so a teammate can retrieve a credential without it sitting in chat.

Approve before updating a config

Route a config update through approval, since changing secrets can break every service reading from it.

02 · ACTIONS

62 Doppler actions, graded by risk.

Every Doppler action is tagged read, write or destructive, so one policy covers the whole app and new actions inherit the right default.

read

Look things up. Allowed by default.

doppler.list_users
List Workplace Users
doppler.get_webhook
Get Webhook
doppler.list_webhooks
List Webhooks
doppler.get_workplace_user
Get Workplace User
doppler.list_service_tokens
List Service Tokens
doppler.list_change_requests
List Change Requests
doppler.list_project_members
List Project Members

write

Create and change things. Allow, or ask the user first.

doppler.add_webhook
Add Webhook
doppler.create_plain
Create Plain Text Share Link
doppler.update_project
Update Project
doppler.update_webhook
Update Webhook
doppler.create_encrypted
Create Encrypted Share Link
doppler.update_workplace
Update Workplace Settings
doppler.update_secret_note
Update Secret Note
doppler.create_service_token
Create Service Token
doppler.auth_me
Get Authenticated User Info
doppler.configs_get
Get Config
doppler.secrets_get
Get Secret
doppler.configs_list
List Doppler Configs
doppler.configs_lock
Lock Config
doppler.invites_list
List Invites
doppler.projects_get
Get Project Details
doppler.secrets_list
List Doppler Secrets

+ 29 MORE

destructive

Delete, cancel or archive. Ask first, or deny outright.

doppler.delete_webhook
Delete Webhook
doppler.delete_service_token
Delete Service Token
doppler.configs_delete
Delete Config
doppler.secrets_delete
Delete Secret
doppler.disable_webhook
Disable Webhook
doppler.projects_delete
Delete Project
doppler.environments_delete
Delete Environment
doppler.groups_delete_member
Remove Group Member
doppler.project_members_delete
Remove Project Member
doppler.dynamic_secrets_revoke_lease
Revoke Dynamic Secret Lease

03 · HOW IT WORKS

Doppler in three steps.

01Your users connect DopplerThey add their Doppler api key on Arc0 Connect, under your brand. It goes straight into the vault.
02You set the rulesReads run, writes like “create Plain Text Share Link” can wait for the user, and “delete Webhook” can be denied outright.
03Any agent can actYour agent calls Doppler through the Arc0 SDK or MCP, and so can Claude, ChatGPT and Cursor. Every call lands on the audit log.

POLICY.TS

await arc0.policies.set('doppler', {
  read: 'allow',
  write: 'ask',        // create_plain
  destructive: 'deny',  // delete_webhook
})

# Claude Code: the same connection, one URL
$ claude mcp add --transport http arc0 \
    https://mcp.arc0.ai/u/u_8f2

04 · AUTH AND DATA

How Doppler connects.

Users add their Doppler api key on Arc0 Connect. It is encrypted in the vault, never shown to the model, and each user can rotate or revoke it at any time.

The same Doppler connection serves your agent over MCP and your own backend over REST and the proxy, so a user connects once. How Arc0 handles credentials →

AUTH: API key
CREDENTIALS: Per-tenant encrypted vault
MODEL SEES: Results only, never credentials
AUDIT LOG: Every call, on every plan

05 · WORKS WITH

Use Doppler from any agent.

Claude

ChatGPT

Cursor

Codex

VS Code

OpenAI Agents SDK

Claude Agent SDK

Vercel AI SDK

Mastra

LangGraph

06 · RELATED

More developer tools apps.

Addressfinder17 actions

Addresszen2 actions

Alchemy36 actions

ALL DEVELOPER TOOLS APPS →

07 · FAQ

Doppler and Arc0, answered.

Q01

Can I use Doppler with Claude, ChatGPT or Cursor?

Yes. Connect Doppler to Arc0 once, then add your Arc0 MCP URL to Claude, ChatGPT, Cursor, Claude Code or any other remote-MCP client. Each assistant only gets the Doppler actions you allow.

Q02

How do users connect Doppler?

Users add their Doppler api key on Arc0 Connect. It is encrypted in the vault, never shown to the model, and each user can rotate or revoke it at any time.

Q03

Which Doppler actions can my agent take?

62 in total: 7 read, 45 write and 10 destructive, such as “create Plain Text Share Link”. Your policies decide which of them each agent may call.

Q04

Can I stop my agent from deleting things in Doppler?

Yes. Actions like “delete Webhook” are graded destructive. Set destructive actions to deny, or to ask so the user approves each one, and blocked calls still show up on the audit log.

Q05

Can my own backend call Doppler too?

Yes. The same Doppler connection is available over REST and through the Arc0 proxy, so your product and your agent share one connection per user.

Get started

Plug Doppler into your agent.

Your users connect Doppler once, under your brand. Your agent gets 62 actions behind your policies, with every call on the record.

Connect Doppler Browse all apps →

Free to build · MCP + REST · Audit log on every plan