SikkerKey

SikkerKey is a secrets manager for teams that run servers, CI pipelines, and automated services that need to read passwords, API keys, database credentials, and other sensitive values. SikkerKey is built around the idea that every machine should have its own access to the secrets it needs, rather than a single API token that gets copied between laptops, CI runners, and production servers.

While most secrets managers hand out one API key that every machine on the team uses to authenticate, SikkerKey's core differentiator is per-machine identity. Each server, container, or CI runner registers once and gets its own cryptographic keypair that never leaves the machine. Access to any given secret is granted to a specific machine, not to an account-wide token. Revoking a machine when it is decommissioned takes one click and leaves the rest of the fleet untouched.

SikkerKey rotates credentials automatically on schedules you control. For database passwords, a small agent running alongside your database applies the new password directly to the role, so your application and your database never drift out of sync. Supported rotation targets include PostgreSQL, MySQL, MariaDB, Redis, MongoDB, and Supabase. SikkerKey also pushes secrets into your CI systems. GitHub Actions, GitLab, Bitbucket, and Supabase projects stay in sync with your vault without copying environment variables by hand. For one-off handoffs with people outside your team, SikkerKey generates one-time links that self-destruct after the recipient views the value once.

Every access, rotation, login, and permission change is recorded in a log that cannot be altered after the fact, even by someone with full administrative access. You can search it, filter it, export it, forward specific events to Slack or PagerDuty via webhook, or receive email alerts on the actions that matter to you.

SikkerKey stores every secret under multiple layers of encryption. The master key that can decrypt them exists only in memory on the server and is never written to disk. Even a full copy of the database yields nothing readable without that key.