Skip to content
SPECIFICTION
Get listed

Keyway

keyway.sh

From €9/mo WebWindowsmacOSLinuxAPISelf-hosted
Visit keyway.sh
Spec score 7.9 #16 of 46 in Secrets Management Tools

What it is

Keyway is an open-source secrets manager that injects environment variables into a running process instead of storing them in a project.env file. Its `keyway run` command makes secrets available while that process runs; they disappear when it stops. Keyway says AI agents reading files from disk cannot see secrets injected this way. Access follows GitHub repository permissions, so removing a person’s repository access also revokes their Keyway access.

Secrets use AES-256-GCM encryption with a unique random IV for each secret. An isolated crypto service holds the encryption key, which Keyway says does not touch its API server or database; connections among the CLI, API, crypto service, and database use TLS 1.3. An audit trail records who accessed which secrets, when, and from where. Documented provider workflows cover Vercel, Netlify, and Railway. CLI binaries are listed for macOS, Linux, and Windows, and the full stack can be self-hosted with Docker Compose. The Free plan includes unlimited public repositories, one private repository, three environments per repository, two provider integrations, and unlimited collaborators. Paid plans are Pro at €9 a month, Team at €19 a month, and Business at €39 a month.

Spec sheet

Purpose
Keyway is an open-source secrets manager that injects environment variables into process memory so they are not stored in a project .env file.Read 3 Oct 2026 · keyway.sh
Integrations
The documented available provider integrations are Vercel, Netlify, and Railway, with workflows to sync secrets.Read 3 Oct 2026 · docs.keyway.sh
Support
The Business plan includes priority support, and Keyway lists [email protected] as its contact email.Read 3 Oct 2026 · keyway.sh
AI assistant access
Keyway says secrets injected by keyway run are not visible to AI agents reading files from disk.Read 3 Oct 2026 · keyway.sh
Audit trail
Keyway logs who accessed which secrets, when, and from where.Read 3 Oct 2026 · keyway.sh
CLI
The keyway run command injects secrets into a process, and the secrets disappear when that process stops.Read 3 Oct 2026 · keyway.sh
Company status
Keyway's legal notice describes it as a personal project in the process of legal structuring.Read 3 Oct 2026 · keyway.sh
Encryption
Secrets are encrypted with AES-256-GCM, using a unique random IV for each secret.Read 3 Oct 2026 · keyway.sh
GitHub access
Keyway uses GitHub repository permissions for secret access, and removing a person's repository access revokes their Keyway access.Read 3 Oct 2026 · keyway.sh
Installation platforms
The CLI installation guide lists macOS, Linux, and Windows binaries.Read 3 Oct 2026 · docs.keyway.sh
Key isolation
The encryption key is held by an isolated crypto service and does not touch the API server or database.Read 3 Oct 2026 · keyway.sh
Out of scope
The stated threat model excludes dynamic secrets, PKI, and database credential rotation.Read 3 Oct 2026 · keyway.sh
Self-hosting
Keyway says its full stack can be self-hosted with Docker Compose.Read 3 Oct 2026 · keyway.sh
Threat model
Keyway says it does not protect secrets from a compromised developer machine or from application code and dependencies that can read the process environment.Read 3 Oct 2026 · keyway.sh
Transport security
Keyway states that connections between its CLI, API, crypto service, and database use TLS 1.3.Read 3 Oct 2026 · keyway.sh

Plans and prices

Pro €9 a month 9€/month 10 private repos · Unlimited environments · Unlimited collaborators Read 3 Oct 2026 · keyway.sh
Team €19 a month 19€/month 20 private repos · Unlimited environments · Audit logs · Member management Read 3 Oct 2026 · keyway.sh
Business €39 a month 39€/month 50 private repos · Unlimited collaborators · Exposure reports · Priority support Read 3 Oct 2026 · keyway.sh
Free Price not published 0€/month Unlimited public repos · 1 private repo · 3 environments per repo · 2 provider integrations · Unlimited collaborators Read 3 Oct 2026 · keyway.sh

Every Keyway plan and price →

Strong points and limits

Strong points

  • Secrets leave the process when it stops
  • GitHub permissions govern secret access
  • CLI binaries listed for three desktop platforms
  • Full stack can be self-hosted with Docker Compose

Limits

  • Does not protect against compromised developer machines
  • Application code can read process environment secrets
  • Dynamic secrets, PKI, and credential rotation are out of scope
  • Secret rotation is not supported

Who it suits

It suits developers or teams that want process-scoped secret injection with GitHub-based access. Teams can use the CLI on macOS, Linux, or Windows, or self-host the full stack.

Verdict

Keyway provides process-based secret injection and several deployment and plan options. Its stated threat model excludes compromised machines and code that can read the process environment.

Where Specifiction places it

Alternatives to KeywayAll alternatives →