Stop chasing .env files.
Start together.

Values marked sensitive are encrypted by the API using Google Cloud KMS before storage. Values marked non-sensitive are stored without KMS encryption. The API decrypts sensitive values for authorized reveal and export requests, so Keyrua is not a zero-knowledge service. Read the security page for the access model and limitations.

Yes. Invite them to your organization first, then add them only to the projects they need from each project's Members tab. Choose Admin or Editor for each assignment. Organization admins inherit admin access to every project, including its secrets.

Editors can view, reveal, export, create, update, and delete secrets, and view secret activity and project access history. Admins can also manage project members, change settings, and delete the project. Editors do not see Settings. Both roles apply to all five environments within the assigned project.

Each project has five environments: LOCAL, TEST, DEVELOPMENT, STAGING, and PRODUCTION. An assigned member's project role covers all five. Environment names keep variable sets separate; they do not add environment-specific permissions.

Activity records secret creation, updates, and deletion for the selected environment, with the key, actor, and timestamp. The Members tab has separate project access history for member additions, role changes, and removals across all environments. Neither history contains previous secret values or records secret reads. Deleting a project also deletes its history.

An organization admin invites a teammate by email from the organization's Members page. After they accept, a project admin opens the project's Members tab, selects Add member, and chooses the teammate and their project role in the dialog. Joining an organization alone does not grant an ordinary member access to its projects.

You can revoke an assigned member's access to one project from its Members tab. Removing someone from the organization blocks subsequent requests to all its projects. Neither action erases downloaded files or invalidates credentials they already received. Revoke or rotate those credentials at the underlying service when required.

If your application already reads environment variables or a .env file, you can use an exported .env file without a Keyrua SDK. The CLI can also inject variables into a new process with keyrua run, without writing a .env file. Retrieve changes with a fresh export, CLI pull, or new run; existing files and processes do not update automatically.

Install the public @keyrua/cli package with npm install --global @keyrua/cli. It requires Node.js 24 or newer. Sign in with keyrua login, then use keyrua init to connect your project. The CLI supports secret management, .env push and pull, change history, and process injection. See the Docs page for the full command reference.

Export each project's environment as a .env file from the web app. Keep authorized copies protected: exports contain plaintext values. Existing local copies can be used during an outage, but new retrievals require the service. There is no customer-operated backup restore or public self-hosting guide at present.

Free: €0/month or €0/year, including 1 project, 50 secrets per environment, 3 team members. Starter: €19/month or €190/year, including 5 projects, 500 secrets per environment, Unlimited team members. Agency: €49/month or €490/year, including Unlimited projects, Unlimited secrets per environment, Unlimited team members. Limits and subscriptions apply per organization. The free plan has no trial expiry. Paid plans include a 7-day trial when you start a subscription through checkout; review the billing details there before confirming.