Skip to content
SPECIFICTION
Get listed

KeyRack

keyrack.io

Free plan APISelf-hosted
Visit keyrack.io
Spec score 7.5 #8 of 25 in Key Management Software

What it is

KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.

Spec sheet

Product
KeyRack is an open-source key management coordination layer that tracks key hierarchies, drives rotation, and delegates cryptographic operations to HSM backends.Read 7 Oct 2026 · keyrack.io
Intended users
The maker identifies regulated industries, multi-cloud platforms, SaaS providers using HYOK, and OpenStack operators as audiences for KeyRack.Read 7 Oct 2026 · keyrack.io
Deployment
KeyRack is software you deploy in your own infrastructure, rather than a hosted cloud KMS.Read 7 Oct 2026 · keyrack.io
Integrations
The commercial AWS KMS shim accepts standard AWS SDK requests, while the commercial Barbican shim exposes the OpenStack Barbican REST API.Read 7 Oct 2026 · keyrack.io
Support
The maker directs users to GitHub issues for project issues and to a responsible disclosure process for security vulnerabilities.Read 7 Oct 2026 · keyrack.io
Audit
Audit events can be delivered through NATS, files, or stdout and include BLAKE3 hash-chain linking; Ed25519 signing is opt-in.Read 7 Oct 2026 · keyrack.io
Backends
Available providers include PKCS#11, HashiCorp Vault Transit, KMIP client, and in-process software for development and testing.Read 7 Oct 2026 · keyrack.io
Commercial limits
GCP Cloud KMS and Azure Key Vault shims are listed as roadmap items and are not implemented today.Read 7 Oct 2026 · keyrack.io
Identity
KeyRack does not bundle an identity provider and can integrate with OIDC-compliant providers including Keycloak, Auth0, Okta, Azure AD, and Google Identity Platform.Read 7 Oct 2026 · keyrack.io
Key custody
With non-exportable keys in an HSM or Vault provider, raw key material remains in that backend; exportable keys may leave through authorized export operations.Read 7 Oct 2026 · keyrack.io
Key hierarchy
It supports KEK-wrapping hierarchies with namespace-scoped rules and cascade operations.Read 7 Oct 2026 · keyrack.io
Policy
Authorization is delegated to an external policy decision point such as Cedar or OPA, with authorization checked on every operation.Read 7 Oct 2026 · keyrack.io
Security limits
TLS is opt-in for gRPC, and the REST listener serves plain HTTP, so the maker recommends terminating HTTPS at a reverse proxy.Read 7 Oct 2026 · keyrack.io

Plans and prices

Open source core Free AGPL-3.0-or-later · self-deployed · commercial extensions are separate Read 7 Oct 2026 · keyrack.io
Commercial licensing Priced on request Contact KeyRack for pricing and evaluation access Commercial extensions include HA clustering, key pooling, AWS KMS and Barbican shims, management UI, vendor HSM adapters, and KMIP server Read 7 Oct 2026 · keyrack.io

Every KeyRack plan and price →

Strong points and limits

Strong points

  • Supports PKCS#11 and HashiCorp Vault Transit backends
  • Authorization is checked on every operation
  • Audit events support BLAKE3 hash-chain linking
  • Open-source core is self-deployed at free

Limits

  • Not a hosted cloud KMS
  • TLS is opt-in for gRPC
  • REST listener serves plain HTTP
  • GCP and Azure KMS shims are not implemented

Who it suits

KeyRack is aimed at regulated industries, multi-cloud platforms, SaaS providers using HYOK and OpenStack operators. It suits teams prepared to deploy and operate key-management software in their own infrastructure.

Verdict

KeyRack coordinates key hierarchies and cryptographic backends while leaving deployment and policy decisions to the operator. Its open-source core is free, but commercial extensions require contacting the maker for pricing.

Where Specifiction places it

Alternatives to KeyRackAll alternatives →