KeyraftConfig & secrets, self-hosted

Store configuration and secrets with versioning, RBAC, audit logs, and live updates - one binary, no external dependencies.

Get started

API reference

Single Go binaryBoltDB · no RedisApache 2.0

Up and running in one command

Docker is the fastest path. Grab the root token from the container logs, then hit the API or web UI on port 7200.

# Start Keyraft
docker run -d -p 7200:7200 \
  -e KEYRAFT_MASTER_KEY=$(openssl rand -base64 32) \
  -v keyraft-data:/data \
  keyraft/keyrafted:latest

# Health check (no auth)
curl http://localhost:7200/v1/health

Why Keyraft

Everything you need to manage config and secrets without a heavyweight platform.

Encrypted secrets

AES-256-GCM at rest. Config stays plain text; secrets are encrypted before they hit disk.

Namespaced KV

Hierarchical namespaces like project/environment/service, with full version history per key.

RBAC tokens

Admin, developer, viewer, and operator roles - or legacy scoped tokens for fine-grained access.

Live watch

Long-poll and SSE streams so apps pick up config changes without polling or restarts.

HTTP / JSON

REST API under /v1, Prometheus metrics, and a built-in web UI for day-to-day ops.

Official SDKs

PHP and Dart clients covering the full API surface.

Client libraries

Pick your stack - PHP and Dart clients for the HTTP API.

PHP

Framework-agnostic client via Composer. PHP 8.2+, ext-curl only.

View docs →

Dart

Published on pub.dev. Pure dart:io - no third-party HTTP deps.

View docs →

How it fits together

Deploy once, namespace per app or environment, let services watch for changes.

Deploy

Binary, Docker, or install script - your infra, your data.

Namespace

Isolate keys per project, env, or service tier.

Authenticate

Issue tokens with roles or scoped read/write access.

Watch

Apps subscribe to changes and reload config live.