01
Bring your .env
Import the variables you already have. Start with a dummy file and keep your application code as it is.
FOR DEVELOPMENT TEAMS & AGENCIES
Stop chasing .env files.
Start together.
One shared home for your project configuration. Import your variables, get your team set up, and run with shared configuration from your terminal.
Free to start. No credit card needed.
Explore the workspaceDummy data only
PROJECT CONFIGURATION
3 variablesYour variables, organized.
VariableValue
APP_URL
https://dev.example.comDATABASE_URL
••••••••••••••••PAYMENT_API_KEY
••••••••••••••••One project. Five environments. A shared starting point.
Choose an environment. Reveal the dummy values. Take the sample file with you.
KMS protection for sensitive values Team plans, without per-seat pricing Public CLI, installed from npm
FROM A TEAM USING KEYRUAAvicenne StudioSoufiane Benbah · Tech Lead
“Keyrua just works. Zero setup headaches, CLI access, and I know my team's credentials are actually safe.”
EXPLORE / NO ACCOUNT NEEDED
Get a feel for the workflow.
Make it your own.
Use the real dashboard interface with sample data. Import, edit, and export before creating your workspace.
Your sample project is ready.
One project. Five environments. Your first change.
01 / THE WORKFLOW
A shared starting point.
One less thing to chase.
02
Give every environment a home
Keep local, test, development, staging, and production configuration in separate namespaces.
03
Bring your team up to speed
Invite a teammate to your organization so they can retrieve the configuration they need for their next project.
02 / FROM DASHBOARD TO TERMINAL
THE CLI IS AVAILABLE
Your configuration.
In your terminal.
Set up your project once. Retrieve the environment you need and start your application with the same configuration your team manages in Keyrua.
- Run with fresh values
Inject variables into a new process with
keyrua run. No .env file is written. - Keep your .env workflow
Pull a local file when you need one. Retrieve changes with a fresh pull or a new run.
START IN YOUR TERMINALPublished on npm
1. Install the CLI
npm install --global @keyrua/cliNode.js 24+ · macOS, Linux & Windows
2. Connect and run your project
keyrua login
keyrua init --project my-app --env development
keyrua run --project my-app --env development -- node server.jsFrom your project directory, sign in through your browser. Replace my-app with your project slug and node server.js with your application's start command.
03 / BUILT ON CLARITY
Your secrets.
A clear trust model.
You should know how your configuration is protected, who can access it, and how to take it with you.
Read the security modelSensitive values, encrypted with Google Cloud KMS
The API encrypts sensitive values before storage and decrypts them for authorized reveal and export requests.
One organization, one shared team
Members can access all projects in their organization. Use separate organizations when teams must not share access.
A familiar way to leave
Export an environment as a .env file. Keep downloaded copies protected: they contain plaintext values.
04 / ROOM TO GROW
Start with one project.
Bring the rest when you're ready.
Simple pricing per organization.
No per-seat multiplication.
Free
Evaluate the workflow with a small team.
€0/ month
No trial expiry
Start free- 1 project
- 50 secrets per environment
- 3 team members
Starter
For a team maintaining a few applications.
€19/ month
Or €190 billed yearly
Start free- 5 projects
- 500 secrets per environment
- Unlimited team members
Agency
For agenciesFor more projects within a trusted team.
€49/ month
Or €490 billed yearly
Start free- Unlimited projects
- Unlimited secrets per environment
- Unlimited team members
Every plan includes CLI access, .env import and export, sensitive-value encryption, and secret change history. Paid plans include a 7-day trial starting at checkout.
05 / BEFORE YOUR FIRST IMPORT
Good questions.
Straight answers.
How does Keyrua protect stored values?
Values marked sensitive are encrypted by the API using Google Cloud KMS before storage. Values marked non-sensitive are stored without KMS encryption. The API decrypts sensitive values for authorized reveal and export requests, so Keyrua is not a zero-knowledge service. Read the security page for the access model and limitations.
Can I restrict a teammate to one client project?
Access is managed at the organization level. Members can access the projects and environments in their organization; there are no per-project or per-environment access restrictions. Use separate organizations for teams that must not share access, and evaluate each organization's plan separately.
Which environments are available?
Each project has five configuration namespaces: LOCAL, TEST, DEVELOPMENT, STAGING, and PRODUCTION. They keep variable sets separate, but do not restrict member access or prevent you from putting a credential in the wrong environment.
What does the change history record?
Secret creation, updates, and deletion are recorded with the key, environment, actor, and timestamp. The history does not contain previous values or record secret reads. Deleting a project also deletes its change history.
How do I invite a second developer?
An organization administrator can invite a teammate by email from the Members screen. Organization membership grants access across that organization's projects. Review the security page before inviting contractors or combining client projects.
What happens when someone leaves the team?
Removing their organization membership blocks subsequent requests to that organization's projects. It does not erase downloaded files or invalidate credentials they already received. Revoke or rotate those credentials at the underlying service when required.
Do I need to change my application code?
If your application already reads environment variables or a .env file, you can use an exported .env file without a Keyrua SDK. The CLI can also inject variables into a new process with keyrua run, without writing a .env file. Retrieve changes with a fresh export, CLI pull, or new run; existing files and processes do not update automatically.
How do I install and use the CLI?
Install the public @keyrua/cli package with npm install --global @keyrua/cli. It requires Node.js 24 or newer. Sign in with keyrua login, then use keyrua init to connect your project. The CLI supports secret management, .env push and pull, change history, and process injection. See the Docs page for the full command reference.
How can I export my data or prepare for an outage?
Export each project's environment as a .env file from the web app. Keep authorized copies protected: exports contain plaintext values. Existing local copies can be used during an outage, but new retrievals require the service. There is no customer-operated backup restore or public self-hosting guide at present.
How much does Keyrua cost, and when does the trial start?
Free: €0/month or €0/year, including 1 project, 50 secrets per environment, 3 team members. Starter: €19/month or €190/year, including 5 projects, 500 secrets per environment, Unlimited team members. Agency: €49/month or €490/year, including Unlimited projects, Unlimited secrets per environment, Unlimited team members. Limits and subscriptions apply per organization. The free plan has no trial expiry. Paid plans include a 7-day trial when you start a subscription through checkout; review the billing details there before confirming.
LESS SETUP FRICTION. MORE TIME TO BUILD.
Give your next project
a better starting point.
Start freeStart with dummy values. Get a feel for the workflow.