Keyraft

Config & Secrets ​

Keyraft stores two types of values: config (plain text) and secret (encrypted at rest).

Config Values ​

Config values are stored in plain text. Use them for non-sensitive settings like hostnames, ports, feature flags, and URLs.

bash
curl -X PUT http://localhost:7200/v1/kv/myapp/prod/DB_HOST \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value":"localhost","type":"config"}'

Secret Values ​

Secrets are encrypted at rest with AES-256-GCM using the KEYRAFT_MASTER_KEY. Use them for passwords, API keys, tokens, and other sensitive data.

bash
curl -X PUT http://localhost:7200/v1/kv/myapp/prod/DB_PASSWORD \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value":"secret123","type":"secret"}'

When retrieved via the API, secrets are decrypted and returned to authorized callers.

Versioning ​

Every write creates a new version. You can retrieve a specific version:

bash
curl "http://localhost:7200/v1/kv/myapp/prod/DB_HOST?version=2" \
  -H "Authorization: Bearer YOUR_TOKEN"

List all versions of a key:

bash
curl http://localhost:7200/v1/kv/myapp/prod/DB_HOST/versions \
  -H "Authorization: Bearer YOUR_TOKEN"

Deleting Keys ​

bash
curl -X DELETE http://localhost:7200/v1/kv/myapp/prod/DB_HOST \
  -H "Authorization: Bearer YOUR_TOKEN"

Master Key ​

The KEYRAFT_MASTER_KEY environment variable controls secret encryption. It must be set before storing any secrets and should be at least 16 bytes (32+ bytes recommended for production).

See Security for best practices.

Apache License 2.0

Copyright © Keyraft