No per-seat charges. No request metering. No surprises.
Start free, upgrade when you need more.
Enough to ship something real.
For solo devs and small teams.
For teams who ship to prod.
Each key-value pair is one secret. DATABASE_URL is one secret, STRIPE_KEY is another. Environment variables that are the same across environments still count once per environment.
Yes. Register your CI runner as a device and set VAULT_KEY + VAULT_DEVICE_SECRET as pipeline variables. Secrets are pulled at build time, never stored in your CI config.
Your app still boots. vault-env maintains an AES-256-GCM encrypted local cache that's refreshed on every successful pull. If the server is unreachable, cached secrets are used.
Not yet, but the vault server is a single Cloudflare Worker with a D1 database. We're considering open-sourcing the server component.
Remove the device from your dashboard. Its device-specific encryption key is immediately invalidated — it can no longer decrypt secrets even if it has the VAULT_KEY.