Keyorix

Lightweight secrets management for teams that can't use SaaS.

On-premise. Air-gapped ready. Single binary. No Vault admin required.

---

Why Keyorix?

	Vault	Doppler	Keyorix
On-premise	Yes	No	Yes
Air-gapped¹	Yes	No	Yes
Simple ops	No	Yes	Yes
EU company	No	No	Yes
Open source	BSL	No	AGPL
Single binary	Yes	N/A	Yes

¹ The core product needs no internet access. Optional integrations that delegate to an external identity provider — OIDC machine-identity federation, SSO login — need network reachability to that provider (which can itself live entirely inside a private network with no internet egress). See Configuration for what's required.

Vault is powerful but requires a dedicated admin. Doppler is simple but SaaS-only. Keyorix is both simple and runs entirely in your infrastructure.

---

Install

curl -L https://raw.githubusercontent.com/keyorixhq/keyorix/main/install.sh | sh

Or build from source:

git clone https://github.com/keyorixhq/keyorix
cd keyorix && make install

---

Quick Start

Self-host the full stack (web UI + API + PostgreSQL) with Docker Compose:

cp .env.example .env   # set KEYORIX_DB_PASSWORD, KEYORIX_MASTER_PASSWORD, admin creds
docker compose up -d   # open http://localhost:8088

See docs/SELF_HOSTING.md for production setup (TLS, backups, upgrades, and the all-important encryption-key handling), and docs/CONFIGURATION.md for the full keyorix.yaml reference (encryption/KEK providers, MFA, WebAuthn, dynamic secrets, OIDC, …).

Or start just the server binary:

KEYORIX_MASTER_PASSWORD=yourpassword keyorix-server

Connect the CLI:

keyorix connect http://localhost:8080 --username admin --password yourpassword

Create and use secrets:

keyorix secret create --name db-password --value supersecret
keyorix run --env production --var DATABASE_URL=db-password -- node app.js
keyorix run --env production --var DATABASE_URL=db-password -- flask run
keyorix run --env production --var DATABASE_URL=db-password -- ./myapp

Secrets are injected as environment variables under the name YOU choose with --var NAME=secret-ref (repeatable). The old behavior — auto-deriving the env var name from the secret's own name (db-password becoming DB_PASSWORD) — is still available via the deprecated --derive-names flag, but is no longer the default: it let whoever names a secret also choose the env var it becomes.

---

Migrate from Vault

# From Vault (Medusa YAML export)
keyorix secret import --file vault-export.yaml --format vault --env 1

# From .env files
keyorix secret import --file .env --format dotenv --env 1

# Preview before importing
keyorix secret import --file vault-export.yaml --format vault --env 1 --dry-run

---

SDKs

Fetch secrets directly from your application at startup. Zero hardcoded credentials.

Go

go get github.com/keyorixhq/keyorix-go

token, _ := keyorix.Login(ctx, "http://your-server:8080", "admin", "password")
client := keyorix.New("http://your-server:8080", token)
dbPassword, _ := client.GetSecret(ctx, "db-password", "production")

Python

pip install keyorix

token = keyorix.login("http://your-server:8080", "admin", "password")
client = keyorix.Client("http://your-server:8080", token)
db_password = client.get_secret("db-password", "production")

Node.js

npm install keyorix

const token = await keyorix.login("http://your-server:8080", "admin", "password");
const client = new keyorix.Client("http://your-server:8080", token);
const dbPassword = await client.getSecret("db-password", "production");

See example apps for full working demos with Docker Compose.

---

Core Features

Secrets management

• Create, read, update, delete secrets with full versioning
• Environment separation: development, staging, production
• Secret sharing between users and groups

Access control

• Role-based access control (RBAC)
• Group-based permissions
• Service tokens for CI/CD and automation

Audit and compliance

• Every access logged: who, what, when, from where
• Two audit layers: audit_events and secret_access_logs
• NIS2 / DORA alignment for European compliance requirements
• Dashboard expiry alerts for secrets approaching rotation deadlines

Developer experience

• keyorix run — inject secrets into any process
• keyorix secret import — migrate from Vault, .env files, JSON
• keyorix connect — single command server authentication
• Web dashboard for teams who prefer a UI

---

Architecture

Single binary. HTTP REST API on port 8080. Web UI on port 3000.

SQLite for development and small teams. PostgreSQL for production.

Air-gapped deployment: copy the binary and run. No internet required. (Optional features that delegate to an external identity provider — OIDC federation, SSO login — need network reachability to that provider; see Configuration.)

---

Security

• AES-256-GCM encryption for all secret values
• Envelope encryption: passphrase → PBKDF2 → KEK (memory only) → wrapped DEK
• Constant-time token comparison (timing attack prevention)
• Secrets never logged or exposed in error messages

Security issues: security@keyorix.com

---

Roadmap

• Kubernetes service account authentication
• Dynamic secrets — credentials generated on-demand with TTL
• MCP server — AI assistant integration
• Java SDK
• Access anomaly detection (NIS2 incident detection)

---

License

AGPL-3.0. Commercial licensing available for enterprise deployments.

Contact: hello@keyorix.com

---

About

Built by Andrei Beshkov, ex-Microsoft Security PM, Valencia, Spain.

Keyorix SL — your data stays in your infrastructure.