Ship secrets,not screenshots.

keyline.sh · 2026-07-16 · by Long Nguyen ·generic
Zero-knowledge secrets manager for small dev teams. Share .env files with one command and audit every change. Encrypted client-side, so even we can't read them.

Ship secrets,not screenshots.

We host your secrets. We can't read them. AES-256 · client-side encryption · audit everything

\# engineeringtoday, 2:47 PM

JD

Jordan 2:46 PM

hey can someone send me the prod keys real quick? deploy is broken 😩

MR

Maria 2:47 PM

here you go, don't share lol

OPENAI\_API\_KEY=sk-proj-51Hb...9aQ2 DATABASE\_URL=postgres://admin:hunter2@…

⚠ now lives in Slack forever

The problem

Your live keys are in a chat thread right now.

Every small team starts the same way. It works, until it doesn't.

  • ✕Slack & DMs keep an unencrypted, searchable copy of your credentials forever. That includes anyone you offboard.
  • ✕Shared drives & pinned docs drift out of date, so half the team runs the wrong key.
  • ✕.env in the repo means one bad `git push` from a public leak and a 3am rotation scramble.
  • ✕No record of who saw what, when. A leak becomes an unanswerable question.

    • How it works

    Up and running in five minutes.

    Keyline speaks .env natively. If your app reads environment variables today, nothing in your code changes. Here is the whole journey, no hidden steps.

    Youabout 2 minutes

    1. 1

    Install the CLI

    One command. macOS, Linux, or Windows. `$ curl -fsSL keyline.sh/install | sh` 2. 2

    Create your account

    Two questions: team name and your email. No card, no browser. `$ keyline login` 3. 3

    Link this folder

    Once per project. Keyline remembers. `$ keyline link acme-api --env prod` 4. 4

    Push your .env

    Encrypted on your laptop before it leaves. We store ciphertext. `$ keyline push`

    the invite email carries the join code

    Your teammateabout 1 minute

    1. 5

    Invite your teammate

    You run this. They get an email with a one-time join code. `$ keyline members invite sam@acme.com` 2. 6

    They join

    Their machine gets its own key. Nothing shared over chat. `$ keyline join QVJX-3F9K-TX2M` 3. 7

    They pull

    The same .env, decrypted only on their machine. `$ keyline pull › wrote .env`

    Day two and beyond: someone leaves, you cut them off in one command. Every read and write lands in a tamper-evident audit log. `$ keyline revoke jordan@acme.com`

    The mental model

    One workspace. A project per repo.

    Your folders stay exactly where they are. keyline link binds each one to a project and an environment, and from then on push and pull just know where to go.

    On your laptop

    \~/code

    ├─ acme-api/

    │ ├─ .env gitignored

    │ └─ .keyline.json safe to commit

    └─ acme-web/

    ├─ .env gitignored

    └─ .keyline.json safe to commit

    keyline link binds folder to environment

    In your workspace

    Acme workspace · your team

    ├─ acme-api project

    │ ├─ prod ← this laptop

    │ └─ staging

    └─ acme-web project

    └─ prod ← this laptop

    Workspace

    Your team. Members, billing, and the audit log live here. You need exactly one.

    Project

    One per repo or app. Created on the fly the first time you link a folder.

    Environment

    prod, staging, dev. Each holds one .env, and access is granted per environment.

    .keyline.json holds ids only, never secrets. Commit it and teammates who pull the repo are one keyline pull away from running the app.

    The demo

    Forty-four seconds. Nothing sped up.

    A real install, push, and pull. Recorded as-is.

    install → login → link → push → pull → run · 44s

    Built for agents

    Agents run your code. They don't need your keys.

    Claude Code, Cursor, CI bots. An agent needs your app to run, not your secrets to read. keyline run keeps values out of prompts, logs, and diffs.

    Out of the context window

    The agent starts your app through Keyline. Secrets are injected in memory, into the app process. Never into the prompt.

    `$ keyline run -- npm test`

    Scoped like any teammate

    Give an agent read on dev and nothing on prod. Tokens expire on their own. Revoke in one command.

    `$ keyline members grant agent@ci --env dev --role read`

    Audited like production

    Every pull an agent makes lands in the tamper-evident log. Who, what, when.

    `$ keyline audit --env dev`

    k\_

    Your machine

    encrypt with your workspace key

    ⬇ a8f3..d91c (ciphertext only)

    ☁

    Keyline servers

    store + sync, can't decrypt

    ⬆ a8f3..d91c (ciphertext only)

    k\_

    Teammate's machine

    decrypt locally → .env

    Zero-knowledge architecture

    Secrets are sealed before they leave your laptop.

    Encryption and decryption happen entirely on your machines. Our servers only ever hold ciphertext.

  • ✓

    • We can't see your secretsThe encryption key is derived from a workspace secret you control. It never touches our servers.

  • ✓

    • A breach of us isn't a breach of youIf someone stole our entire database, they'd get a pile of unreadable bytes.

  • ✓

    • No subpoena, no insider, no accidentYou can't hand over data you mathematically cannot read. Neither can we.

    Everything a small team needs

    Boring infrastructure. Flawlessly executed.

    ⌘

    #### One-command CLI

    Install in seconds, no concepts to learn. keyline pull and you're working.

    ⊞

    #### Per-environment access

    Scope people to dev, staging, or prod. Interns never see live keys; seniors get everything.

    ≡

    #### Tamper-evident audit log

    Every read, write, and denied attempt is recorded with who, what, and when.

    ⎇

    #### Git-safe by design

    Secrets sync through Keyline, never your repo. Commit your code, not your credentials.

    ↻

    #### Instant revoke & rotate

    Someone leaves? Pull their access in one command and rotate what they touched.

    ⊕

    #### Deploy anywhere

    Vercel, Railway, Fly, your own boxes. If it reads env vars, Keyline feeds it.

    Accountability

    Answer "who touched prod?" in one glance.

    When something goes wrong, or an auditor asks, you have a clean, exportable record. No frantic scroll through DMs.

    keyline · acme-api · audit live

    14:52:09maria@pulled prod · 14 keysREAD

    14:48:31maria@rotated OPENAI\_API\_KEYWRITE

    14:41:02jordan@denied · prod not in scopeDENY

    11:09:55sam@pulled staging · 9 keysREAD

    09:17:40maria@revoked access for leo@WRITE

    Pricing

    One flat price. No per-seat math.

    We don't charge you more as your team grows. Pick a plan, share your secrets, get back to building.

    Solo

    $0 /forever

    For individual developers and side projects.

  • ✓ 1 developer
  • ✓ Up to 2 environments
  • ✓ Full CLI & zero-knowledge encryption
  • ✓ 7-day audit history
    • Sign up free

    FOR TEAMS

    Team

    $19 /month, flat

    For 2–10 person teams that share secrets daily.

  • ✓ Up to 10 members · no per-seat fees
  • ✓ Unlimited environments & projects
  • ✓ Per-environment access control
  • ✓ Unlimited, exportable audit log
  • ✓ Instant revoke, rotate & SSO-ready
Sign up

Questions

The things you're right to ask.

#### If it's zero-knowledge, what happens if we lose our key?

Your workspace key is recoverable through any active admin's device, and we offer an optional sealed recovery file you store yourself. We genuinely can't reset it for you. That's the whole point. Recovery stays in your hands.

#### Do I really not have to change my app code?

Correct, with one honest caveat: instead of a committed `.env`, your team runs `keyline pull` (or wraps startup in `keyline run`). Your app still just reads environment variables. Nothing in your codebase changes.

#### How is this different from Doppler or Vault?

Those are powerful and can feel heavy for a 3-person team. Keyline is deliberately narrow: `.env`\-native, one flat price, zero-knowledge, and nothing to configure. If you outgrow simple, they're great. We won't pretend otherwise.

#### What's your security posture?

Client-side AES-256 encryption, TLS everywhere, scoped access tokens, and a tamper-evident audit trail anchored publicly every day. Our encryption design is public so you can verify the claims, not trust them. SOC 2 readiness is underway. Full details at keyline.sh/security.

Get your keys out of Slack today.

Free for solo devs. $19 flat for your whole team. Two minutes to set up.

$ curl -fsSL keyline.sh/install | sh click to copy

Sign up → Read the security design

×

Join the waitlist

Keyline is in early development. Drop your email and we'll tell you when it's ready. No spam.

Notify me →

keyline.sh · 2 videos · 10 links

Comments (0)

No comments yet