KeyRack

KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure rather than use as a hosted cloud KMS. It tracks key hierarchies, coordinates rotation, and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on each operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can work with OIDC-compliant providers including Keycloak, Auth0, Okta, Azure AD, and Google Identity Platform. Backend options include PKCS#11, HashiCorp Vault Transit, a KMIP client, and in-process software for development and testing. Audit events can be sent through NATS, files, or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there, while authorized export operations can release exportable keys. The self-deployed open-source core is licensed AGPL-3.0-or-later at no cost. Commercial extensions are separate and priced by request.

KeyRack offers self-hosted key coordination with external authorization and configurable backends. Its deployment and transport-security requirements, as well as separate commercial extensions, are important to weigh.

KeyRack is aimed at regulated industries, multi-cloud platforms, SaaS providers using HYOK, and OpenStack operators. It may suit teams prepared to deploy and manage key coordination in their own infrastructure.

KeyRack is a self-hosted control layer for teams coordinating keys across HSM, Vault, or KMIP infrastructure. It fits regulated organizations, multi-cloud and HYOK operators, and OpenStack teams that already run identity and policy services. The free core is capable and auditable, but deployment security and several production integrations demand engineering effort or a commercial license.

Overview

KeyRack organizes key use without becoming a hosted cloud KMS. It tracks key hierarchies, drives rotation, and sends cryptographic work to configured backends. Supported backends include PKCS#11, HashiCorp Vault Transit, a KMIP client, and an in-process provider intended for development and testing. Customer-managed keys can remain non-exportable in an HSM or Vault; exportable keys can leave their backend when an authorized export operation permits it.

Operation is your responsibility because the software is deployed in your infrastructure. KeyRack does not include an identity provider, and authorization is delegated to an external policy decision point. The REST listener uses plain HTTP, while gRPC TLS is opt-in, so production installations should place HTTPS termination at a reverse proxy and treat transport configuration as part of the security design.

Key features

Hierarchy and policy control

KEK-wrapping hierarchies, namespace-scoped rules, and cascade operations provide structure for grouped keys and coordinated changes. Authorization is checked on every operation through systems such as Cedar or OPA. This separation is useful when policy must be maintained independently, but it adds another service boundary to deploy and govern.

Backend flexibility and custody

PKCS#11, Vault Transit, and KMIP connectivity let organizations retain established key stores, while the software provider gives developers a non-production path. Non-exportable HSM or Vault keys keep raw material in the backend; export permissions therefore become a critical custody boundary for any exportable key.

Audit and identity integration

Audit events can flow to NATS, files, or standard output and include BLAKE3 hash-chain links. Optional Ed25519 signing adds an authenticity layer when enabled. OIDC-compatible providers including Keycloak, Auth0, Okta, Azure AD, and Google Identity Platform can supply identity, but configuring and operating that provider remains outside KeyRack.

Commercial adapters

Commercial extensions add an AWS KMS shim that accepts standard AWS SDK requests and a Barbican shim exposing the OpenStack Barbican REST API. HA clustering, key pooling, a management UI, vendor HSM adapters, and a KMIP server are also commercial features. GCP Cloud KMS and Azure Key Vault shims are roadmap items, not current capabilities.

Pricing

Open source core

The Open source core costs nothing under AGPL-3.0-or-later and is self-deployed. It suits teams able to operate the service themselves and connect their own identity, policy, and key backends. Commercial extensions are separate, so this free plan does not include the listed enterprise adapters, clustering, pooling, UI, or KMIP server.

Commercial licensing

Commercial licensing uses custom pricing: contact KeyRack for pricing and evaluation access. It is the relevant route for organizations needing HA clustering, key pooling, AWS KMS or Barbican compatibility, management UI, vendor HSM adapters, or a KMIP server. No seat, quota, trial, or renewal terms are stated.

Platforms

KeyRack is delivered as an API and self-hosted software. It is not a hosted cloud service, so infrastructure, reverse-proxy TLS termination, identity integration, and policy-service operation belong in your deployment plan.

Who it's for

Regulated industries can use the hierarchy, custody, and audit model when keeping keys in controlled infrastructure matters. Multi-cloud platforms and SaaS providers using HYOK benefit from coordinating customer-managed keys across existing backends. OpenStack operators have a direct Barbican path through the commercial shim. Teams wanting a turnkey hosted KMS, bundled identity, or encrypted listeners by default should look elsewhere.

Pros and cons

Pros

• Backend choice: PKCS#11, Vault Transit, KMIP, and a development provider accommodate varied key estates.
• Strong custody options: non-exportable HSM or Vault keys keep raw material in the selected backend.
• Auditable operations: NATS, file, and stdout delivery plus BLAKE3 hash chaining support centralized event handling.
• Free core: the AGPL self-deployed edition provides hierarchy and coordination capabilities without a license charge.

Cons

• Operational burden: you must run the service and supply identity and policy components.
• Transport defaults need work: REST is plain HTTP and gRPC TLS is opt-in, requiring deliberate reverse-proxy configuration.
• Key integrations cost extra: AWS KMS, Barbican, HA, UI, pooling, vendor adapters, and KMIP server require commercial licensing.
• Cloud coverage is incomplete: GCP Cloud KMS and Azure Key Vault shims are not implemented.

Alternatives

Entrust Certificate Manager is a paid, multi-platform certificate-management option when you prefer a vendor product over self-deployed open-source coordination.

Thales CipherTrust Data Security Platform is a freemium, self-hosted and web-capable alternative with a free-forever Community Edition and a free trial.

Oracle Cloud Infrastructure Secret Management fits API and web users seeking a free OCI service with stated tenancy and secret-version limits.

Kleopatra is a free, open-source certificate manager for Linux and Windows.

OpenStack Barbican is a free, API-oriented open-source option for OpenStack environments.

AWS Key Management Service suits teams wanting a managed AWS service, with keys billed at $1 a month and separate API charges.

Cryptsoft KMIP Server is a paid SDK choice for organizations specifically needing C or Java KMIP server components.

OpenKCM (Open Key Chain Manager) is another free API and self-hosted key-management option.

Browse more options in Key Management Software.

Verdict

Choose KeyRack if you need an open-source, self-hosted coordination layer that keeps key custody in your HSM or Vault estate and can be governed through external policy. Its main advantage is control across heterogeneous backends at no cost for the core. Look elsewhere if you need a hosted KMS, built-in identity, secure transport enabled by default, or ready-made AWS, Barbican, GCP, or Azure integrations without commercial licensing.