Every environment's secrets, in one place.
Set your API keys, database passwords and service tokens once for production, preview and development. Functions and apps read them with no network call, servers and CI with a token, and every read and change is recorded. Values are encrypted at rest with a key for each team.
What you get
Projects and environments
Group secrets in projects. Each project has production, preview and development (or environments of your own), and each secret has its own value in each.
Versions and rollback
Every change is a new version, with its time, author and note. Go back to an earlier one with one command.
Tokens scoped to a project
Give a server, CI or script a token that sees one project only: read-only or read-write, all environments or some, with an expiry date.
An audit trail
Which person or token read or changed which secret, in which environment, from which address. A value never appears in it.
Rotation reminders
Say how many days a project's or a secret's values should live. When one is due, the team hears in the notification centre and by email; set a new value or generate a random one.
env.SECRETS in functions and apps
Link a secrets project to a function or app and read env.SECRETS.get("NAME"), or each secret as env.NAME. No network call and no token in your code; changes arrive without a redeploy.
run -- and pull in the CLI
cloudhost run -- <command> starts any program with an environment's secrets as its environment variables and writes nothing to disk. secrets pull puts the non-sensitive values in .env.local.
A REST API
Any program, anywhere, reads its secrets with an HTTPS request and a project token. The same API the dashboard and the CLI use.
An SDK
new Secrets({ token }) for TypeScript, in Node, browsers and functions, with a short in-memory cache so rotations arrive without a restart.
Four ways into one secrets project
Set them from the CLI, run with run --, read env.SECRETS in a function, and REST from anywhere else.
cloudhost secrets create shop --rotate-days 90
printf %s "$STRIPE_KEY" | cloudhost secrets set STRIPE_KEY --project shop --env production
cloudhost secrets list --project shopPer secret and per read
You pay for the secrets kept each month and for reads, taken from your wallet with the rest of your usage. Reading env.SECRETS in a function is not counted. Hobby includes a free amount each month.
Questions
Each value is encrypted at rest with a key that belongs to your team alone, and never appears in logs or the audit trail. The viewer and billing roles never see a value, and showing or rotating one in the dashboard asks for a second factor.
Yes. A restricted project is seen only by owners, admins and the people listed on it, each with read or write access. A token never reaches more than the person who made it.
No. Linked functions and apps get the new value without a redeploy. run -- fetches the current values each time it starts.
A sensitive secret is never written to a file: secrets pull leaves it out, and only run -- or the function itself gets it. A plain one, such as an address, goes into .env.local too. Secrets are sensitive by default and stay so.
They stay where they are, and free. Secrets is for when one value is needed by several projects or outside the platform, or when you want versions, tokens, an audit trail and rotation reminders.
Up to 5 KB: enough for a key, a password, a certificate or a piece of JSON. How many projects, environments and tokens you get depends on the plan.
Store your first secret
One project, three environments, one command.
Sign-up is by invite for now. If you have a code, create your account.
Sign up withEmail codeSMS code