Introduction

Keyraft is a lightweight, self-hosted configuration and secrets management system. It stores configuration and secrets securely, manages versioning, and provides live updates through a simple HTTP/JSON API.

Features

• Key-value store with versioning
• Encrypted storage (AES-256-GCM) for secrets
• Namespaces for isolation (project/environment/service)
• Token-based authentication with role-based access control (RBAC)
• Historical version tracking
• Watch API for live updates (SSE streaming + long-polling)
• HTTP/JSON protocol under /v1
• Prometheus metrics endpoint
• Official PHP and Dart client libraries
• Built-in web UI (token login, keys, tokens, audit)

Use Cases

• Centralize application configuration across environments
• Store and rotate secrets without baking them into images
• Push config changes to running services via the watch API
• Audit who accessed or changed which keys

Architecture

Keyraft runs as a single binary (or Docker container) listening on port 7200 by default. All data is stored locally in a data directory. Clients authenticate with Bearer tokens and interact with the /v1 API.

┌─────────────┐     HTTP/JSON      ┌──────────────┐
│  Your App   │ ◄──────────────► │   Keyraft    │
│  (SDK/curl) │    Bearer token   │  :7200 /v1   │
└─────────────┘                   └──────────────┘

Next Steps

• Installation - Docker, binaries, or from source
• Quick Start - Initialize, start, and make your first API call
• API Overview - Full HTTP API reference

Community

• GitHub: keyraft/keyrafted
• Docker Hub: keyraft/keyrafted
• Issues: GitHub Issues
• Security: Report vulnerabilities to xentixar@gmail.com

License

Apache License 2.0