- Home
- Secrets Management Tools
- Keyway
Keyway
What it is
Keyway is an open-source secrets manager that injects environment variables into a running process instead of saving them in a project .env file. Its `keyway run` command makes secrets available while the process runs; they disappear when it stops. Keyway says AI agents that read files from disk cannot see secrets injected this way. Access follows GitHub repository permissions, so removing someone's repository access also removes their Keyway access. Secrets use AES-256-GCM encryption with a unique random IV for each secret. An isolated crypto service holds the encryption key, which Keyway says does not touch its API server or database; connections among the CLI, API, crypto service and database use TLS 1.3. An audit trail records access details. Documented provider integrations include Vercel, Netlify and Railway, with workflows to sync secrets. CLI binaries are listed for macOS, Linux and Windows, and the full stack can be self-hosted with Docker Compose. Keyway's stated threat model does not cover compromised developer machines or application code and dependencies that can read the process environment. Plans include a free plan with paid options; Pro is €9 a month.
For and against
For
- Secrets disappear when the process stops
- GitHub repository permissions govern access
- Audit trail records secret access details
- CLI binaries for macOS, Linux and Windows
- Free plan and paid Pro plan at €9 a month
Against
- Does not protect against compromised developer machines
- Does not protect against code that can read process environments
- Dynamic secrets are out of scope
- Secret rotation is not supported
The verdict
Keyway focuses on keeping environment variables out of project files and tying access to repository permissions. Its stated threat-model exclusions and lack of secret rotation matter when assessing fit.
Who it suits
Keyway suits developers or teams that want to inject secrets into processes and manage access through GitHub repository permissions. It offers both hosted use and self-hosting with Docker Compose.
Plans and prices
Pro
10 private repos · Unlimited environments · Unlimited collaborators
Read 3 Oct 2026 · keyway.sh
Team
20 private repos · Unlimited environments · Audit logs · Member management
Read 3 Oct 2026 · keyway.sh
Business
50 private repos · Unlimited collaborators · Exposure reports · Priority support
Read 3 Oct 2026 · keyway.sh
Free
Unlimited public repos · 1 private repo · 3 environments per repo · 2 provider integrations
Read 3 Oct 2026 · keyway.sh
On the record
- AI assistant access
- Keyway says secrets injected by keyway run are not visible to AI agents reading files from disk.keyway.sh · read 3 Oct 2026
- Audit trail
- Keyway logs who accessed which secrets, when, and from where.keyway.sh · read 3 Oct 2026
- CLI
- The keyway run command injects secrets into a process, and the secrets disappear when that process stops.keyway.sh · read 3 Oct 2026
- Company status
- Keyway's legal notice describes it as a personal project in the process of legal structuring.keyway.sh · read 3 Oct 2026
- Encryption
- Secrets are encrypted with AES-256-GCM, using a unique random IV for each secret.keyway.sh · read 3 Oct 2026
- GitHub access
- Keyway uses GitHub repository permissions for secret access, and removing a person's repository access revokes their Keyway access.keyway.sh · read 3 Oct 2026
- Installation platforms
- The CLI installation guide lists macOS, Linux, and Windows binaries.docs.keyway.sh · read 3 Oct 2026
- Integrations
- The documented available provider integrations are Vercel, Netlify, and Railway, with workflows to sync secrets.docs.keyway.sh · read 3 Oct 2026
- Key isolation
- The encryption key is held by an isolated crypto service and does not touch the API server or database.keyway.sh · read 3 Oct 2026
- Out of scope
- The stated threat model excludes dynamic secrets, PKI, and database credential rotation.keyway.sh · read 3 Oct 2026
- Purpose
- Keyway is an open-source secrets manager that injects environment variables into process memory so they are not stored in a project .env file.keyway.sh · read 3 Oct 2026
- Self-hosting
- Keyway says its full stack can be self-hosted with Docker Compose.keyway.sh · read 3 Oct 2026
- Support
- The Business plan includes priority support, and Keyway lists [email protected] as its contact email.keyway.sh · read 3 Oct 2026
- Threat model
- Keyway says it does not protect secrets from a compromised developer machine or from application code and dependencies that can read the process environment.keyway.sh · read 3 Oct 2026
- Transport security
- Keyway states that connections between its CLI, API, crypto service, and database use TLS 1.3.keyway.sh · read 3 Oct 2026
