Keyline is the dead-simple secrets manager for small teams. Share your .env files with one command, lock down access per environment, and audit every change. Encrypted so even we can't read your keys.
Every small team starts the same way. It works, until it doesn't.
git push from a public leak and a 3am rotation scramble.Keyline speaks .env natively. If your app reads environment variables today, nothing in your code changes. Here is the whole journey, no hidden steps.
One command. macOS, Linux, or Windows.
$ curl -fsSL keyline.sh/install | sh
Two questions: team name and your email. No card, no browser.
$ keyline login
Once per project. Keyline remembers.
$ keyline link acme-api --env prod
Encrypted on your laptop before it leaves. We store ciphertext.
$ keyline push
You run this. They get an email with a one-time join code.
$ keyline members invite sam@acme.com
Their machine gets its own key. Nothing shared over chat.
$ keyline join QVJX-3F9K-TX2M
The same .env, decrypted only on their machine.
$ keyline pull › wrote .env
$ keyline revoke jordan@acme.com
Your folders stay exactly where they are. keyline link binds each one to a project and an environment, and from then on push and pull just know where to go.
Your team. Members, billing, and the audit log live here. You need exactly one.
One per repo or app. Created on the fly the first time you link a folder.
prod, staging, dev. Each holds one .env, and access is granted per environment.
.keyline.json holds ids only, never secrets. Commit it and teammates who pull the repo are one keyline pull away from running the app.
A real install, push, and pull. Recorded as-is.
Claude Code, Cursor, CI bots. An agent needs your app to run, not your secrets to read. keyline run keeps values out of prompts, logs, and diffs.
The agent starts your app through Keyline. Secrets are injected in memory, into the app process. Never into the prompt.
$ keyline run -- npm test
Give an agent read on dev and nothing on prod. Tokens expire on their own. Revoke in one command.
$ keyline members grant agent@ci --env dev --role read
Every pull an agent makes lands in the tamper-evident log. Who, what, when.
$ keyline audit --env dev
Encryption and decryption happen entirely on your machines. Our servers only ever hold ciphertext.
Install in seconds, no concepts to learn. keyline pull and you're working.
Scope people to dev, staging, or prod. Interns never see live keys; seniors get everything.
Every read, write, and denied attempt is recorded with who, what, and when.
Secrets sync through Keyline, never your repo. Commit your code, not your credentials.
Someone leaves? Pull their access in one command and rotate what they touched.
Vercel, Railway, Fly, your own boxes. If it reads env vars, Keyline feeds it.
When something goes wrong, or an auditor asks, you have a clean, exportable record. No frantic scroll through DMs.
We don't charge you more as your team grows. Pick a plan, share your secrets, get back to building.
Your workspace key is recoverable through any active admin's device, and we offer an optional sealed recovery file you store yourself. We genuinely can't reset it for you. That's the whole point. Recovery stays in your hands.
Correct, with one honest caveat: instead of a committed .env, your team runs keyline pull (or wraps startup in keyline run). Your app still just reads environment variables. Nothing in your codebase changes.
Those are powerful and can feel heavy for a 3-person team. Keyline is deliberately narrow: .env-native, one flat price, zero-knowledge, and nothing to configure. If you outgrow simple, they're great. We won't pretend otherwise.
Client-side AES-256 encryption, TLS everywhere, scoped access tokens, and a tamper-evident audit trail anchored publicly every day. Our encryption design is public so you can verify the claims, not trust them. SOC 2 readiness is underway. Full details at keyline.sh/security.
Free for solo devs. $19 flat for your whole team. Two minutes to set up.
Prefer a human? Book 15 minutes with the founder and I'll set it up with your team, live.