Keyline

Share .env files with one command. Encrypted so even we can't read them.

We host your secrets. We can't read them.

Keyline is a hosted, zero-knowledge secrets manager for small dev teams (2 to 10 people). Stop pasting API keys into Slack and committing .env files. Encryption and decryption happen client-side. Our servers only ever hold ciphertext.

Why

Small teams share secrets in ways that are convenient and dangerous: keys pasted into Slack/DMs, drifting shared docs, .env one bad git push from a public leak, and no audit trail when something leaks. The "correct" alternatives feel heavy for a 3-person team. Keyline is the simple, honest one.

How it works

Three commands. No new format to learn. If your app reads env vars today, you're done.

keyline link             # bind this directory (project = folder name; --env to pick)
keyline push             # encrypt local .env -> workspace
keyline pull             # decrypt workspace -> local .env
keyline run -- <cmd>     # inject vars into a process, no file written

Goal: install → link → pull in under two minutes.

Zero-knowledge, honestly

• Client-side AES-256-GCM encryption; servers store only ciphertext, wrapped keys, metadata, and audit events.
• The workspace key is derived from a secret you control and never reaches our servers.
• Member access uses envelope encryption. The workspace key is wrapped per device. Adding or removing a member re-wraps it instead of re-encrypting everything.
• A breach of us is not a breach of you. This claim must stay true and publicly verifiable. See the encryption design doc (milestone M1).

Honest caveat: lost key with no recovery = unrecoverable. That's the point. Recovery is offered via any active admin device or an optional sealed recovery file you hold yourself.

Pricing

Plan	Price	For
Solo	$0 forever	1 dev, ≤2 environments, full CLI + zero-knowledge, 7-day audit history
Team	$19/mo flat	≤10 members (no per-seat), unlimited envs, per-env access, full audit, revoke/rotate

Repository layout

This is a pnpm TypeScript monorepo.

apps/
  cli/        # the keyline CLI (Node + TypeScript)
  api/        # backend API (Node + Postgres)
  web/        # dashboard (React + TypeScript)
packages/
  crypto/     # client-side encryption library (shared by cli + web)
  shared/     # shared types and utilities
api/          # Vercel serverless entry — mounts the Hono API at /api
docs/         # encryption-design, api, infra, observability, decisions/, security-review/
index.html    # landing page (self-contained)

Development

Requires Node 20+ and pnpm.

pnpm install
pnpm build        # build all packages
pnpm typecheck    # type-check the workspace
pnpm lint         # lint
pnpm test         # run tests

Install

curl -fsSL keyline.sh/install | sh      # or: npm i -g @keylinesh/cli

Homebrew: brew tap keyline/keyline https://github.com/keylinesh/homebrew-keyline && brew install keyline.

Project status

CLI, dashboard, and payments shipped; trust and launch next. Roadmap tracked as GitLab milestones M0–M6.

• M0 Foundations — done (monorepo, CI, docs).
• M1 Crypto Core — done. packages/crypto: AES-256-GCM bundles, scrypt KDF, X25519 device keypairs, sealed-box envelope wrap/unwrap, admin + sealed-file recovery; known-answer + property/fuzz tests. (External security review is the launch gate, still pending — backlog #18.)
• M2 Backend API & Data Model — done. apps/api (Hono): device auth + scoped tokens, workspace/project/environment CRUD, push/pull encrypted bundles, per-environment RBAC, tamper-evident hash-chained audit log, revoke/rotate, rate-limiting/validation/security-headers/TLS, structured logs + metrics. Runs on Neon (Postgres) and is live as a Vercel function (/api/health). ~127 tests; CI includes a real-Postgres job.
• M3 CLI — done. apps/cli, published as @keylinesh/cli (v0.1.0): login (interactive first run), link, push/pull (client-side crypto, optimistic concurrency), run (in-memory injection, exit/signal passthrough), rotate/revoke, audit/members (--json). Measured first run under a minute (docs/first-run.md). Distribution: npm + curl | sh + Homebrew tap, checksums per release, tag-driven release CI (docs/distribution.md). 44s demo on the landing page, re-recordable from demo/demo.tape. ~132 CLI+API+crypto tests.
• M4 Web Dashboard — done. apps/web (React + Vite), live at keyline.sh/app, metadata-only (never sees secret values). Sign-in via CLI-approved sessions (keyline web <code>, ADR-0003). Projects/environments with role-aware CRUD, member management (invite/grant/revoke), audit viewer (chain verify, filters, CSV/JSON export), settings + guided onboarding. ~30 web tests; screenshots attached to every UI MR.
• M5 Payments — done. Paddle as Merchant of Record (ADR-0004): Solo free / Team $19 flat with a 14-day trial, verified end to end against production with a real sandbox charge (checkout → webhook → plan flip, VAT computed, invoice issued). Server-side entitlements (seats, environments, audit retention), signed + idempotent webhooks, explicit subscription state machine with a past_due grace period, customer portal, daily Paddle↔DB reconciliation, and legal pages. Billing internals in docs/billing.md. ~129 API tests, 39 web tests.
• Hardening sprint (post-M5) — done. Teammate join flow via one-time codes (keyline join, emailed invitations), email magic-link sign-in for the dashboard (device-bound, single-use), public audit-chain anchoring (daily witness in keyline-anchors — history rewrites are detectable even by us), device keys in the OS keychain via a native binding (no secret on any command line), Sentry error tracking, native single-file binaries for Linux/Windows per release. CLI releases v0.1.1 + v0.1.2. ~316 tests across the workspace.
• M6 Trust, Compliance & Launch — next. Public encryption doc, security posture + vulnerability disclosure, external review (#18, the launch gate), beta → launch.

Docs: encryption design · API reference · first run · distribution · infra/deploy · billing · observability · ADRs · security review packet. Full positioning + risk list in keyline-context.md.

License

TBD.

Where things live

• This repo (GitHub): the public home. Stars, issues, and the source.
• GitLab: CI and merge requests (development happens here; GitHub mirrors main).
• Public audit anchors: every workspace's audit chain head, witnessed daily. They stay on GitLab on purpose: a witness is only as good as its unbroken history.

Install

curl -fsSL https://keyline.sh/install | sh      # or:
npm i -g @keylinesh/cli                          # or:
brew tap keylinesh/keyline && brew install keyline