## What the DVE agent is

The PhantomKey DVE Agent (`PK-DVE-Agent`) is a local Electron application — the cryptographic endpoint on each user's machine.

### Local encryption Encryption and decryption happen on the device using keys derived from the user's passphrase.

### Opaque storage The DVE backend stores encrypted envelopes only — never plaintext credentials.

### Keys stay local Passphrases and derived encryption keys never leave the endpoint.

## Deployment modes

Every user who needs credential access must have the agent installed before they can unlock DVE.

### Automated (MDM) Enterprise fleets managed with Jamf, Intune, or Apple Business Manager.

Jamf · Intune · ABM

### Manual install Small teams, pilots, contractors, or machines outside MDM scope.

Manual installation guide →

Configure deployment mode in the DVE Admin Dashboard under Deployment. IT Admins and Super Admins can update settings and confirm the agent-required policy.

## Agent manifest API Deployment tools and install scripts consume version metadata from the DVE API: - **Public (no auth):** `GET /api/deployment/agent-manifest` - **Org-scoped (agent token):** `GET /api/orgs/{org_id}/deployment/agent-manifest` The manifest returns `version`, `min_supported_version`, platform-specific `download_urls`, and `checksum_url` for integrity verification. When fields are `null`, contact your PhantomKey administrator to set `AGENT_VERSION` and `AGENT_DOWNLOAD_BASE_URL` on the DVE backend.

## Prerequisites

### Network Outbound HTTPS from target machines to your DVE API base URL and agent download CDN.

### MDM rights Jamf Pro, Microsoft Intune, or ABM-linked MDM admin access for automated rollout.

### Manual installs Local administrator rights on the target machine (macOS, Windows, or Linux x64).

### Provisioned users DVE user accounts created in your organization before agents can unlock.

## Troubleshooting | Symptom | Likely cause | Action | |---------|--------------|--------| | User cannot unlock DVE | Agent not installed | Install per [manual guide](manual.md) or verify MDM policy deployed | | Agent shows "update required" | Client below `min_supported_version` | Deploy current version from manifest | | MDM script fails checksum | Wrong platform binary or stale manifest | Re-fetch manifest; verify `AGENT_DOWNLOAD_BASE_URL` | | Manifest returns null URLs | Server env not configured | Set `AGENT_VERSION` and `AGENT_DOWNLOAD_BASE_URL` on DVE backend |

## Connectors (machine identities) For **non-human identities** — CI/CD pipelines, Kubernetes workloads, and automated scripts — DVE provides connector packages that pull secrets from the **agentless secret vending API** using a scoped service account. The **DVE Agent remains required for human users** on laptops and workstations. Connectors complement agent deployment; they do not replace it.

Connectors setup guide →

## Related guides - [Manual installation](manual.md) - [Jamf Pro deployment](mdm-jamf.md) - [Microsoft Intune deployment](mdm-intune.md) - [Apple Business Manager + MDM](mdm-apple-business-manager.md) - [Connectors setup guide](connectors.md) - [Deployment guides index](index.md)