Open Source Azure Key Vault Alternatives

Vault gives a system one interface for every secret it needs, whether that is a database credential, an API key for an external service or a certificate. The difficulty it addresses is bookkeeping: knowing who reached which secret is already platform specific and awkward, and adding key rolling, encrypted storage and an audit trail on top usually means a custom solution nobody wants to own.

Instead, secrets are read through Vault, which enforces tight access control and records a detailed audit log of every request. Storage backends vary, from local disk to Consul and others.

What matters is how secrets are issued and taken away.

• Secure storage: arbitrary key and value pairs encrypted before they are written, so raw storage access is not enough to read them.
• Dynamic secrets: credentials generated on demand for systems such as AWS or SQL databases, then revoked automatically once the lease ends.
• Encryption without storage: data encrypted and decrypted by Vault while living elsewhere, letting security teams set the parameters and developers keep ciphertext in a SQL database.
• Leasing and renewal: every secret carries a lease, with built in APIs for clients to renew before it expires.
• Revocation: single secrets or whole trees revoked at once, for instance everything read by one user, which helps with key rolling and with locking a system down after an intrusion.

Vault is written in Go and builds from source once the toolchain is in place. HashiCorp publishes documentation, tutorials, example applications in several languages and a certification exam.

Infisical centralizes application secrets and configuration across every environment so credentials stop living in shared files and chat threads. What began as a secrets tool now spans certificates, encryption keys and privileged access, with the stated aim of making security tooling usable by people who do not work in security.

Secrets are managed per project and environment from a dashboard, with versioning, point-in-time recovery and rotation built in. Syncs push values out to platforms such as GitHub, Vercel and AWS, while Terraform and Ansible integrations, a Kubernetes operator and an agent deliver them into running workloads without touching application code.

The platform is organized into distinct products over a shared control layer.

• Secrets management: Dynamic short-lived credentials, scheduled rotation and scanning that keeps secrets out of git.
• Certificate management: A private PKI with internal and external CAs, issuance policies, expiry alerting and code signing.
• Key management: Cryptographic keys held centrally and used to encrypt and decrypt project data.
• Privileged access: Just-in-time brokered access to PostgreSQL, SSH, Kubernetes and Active Directory, with session recording.
• Platform controls: Role-based access, temporary privileges, approval workflows and audit logs with optional streaming.

Machine identities authenticate through Kubernetes, GCP, Azure, AWS, OIDC or universal auth, and a gateway reaches private network resources without inbound connections. Client SDKs cover Node, Python, Go, Ruby, Java and .NET alongside a CLI, and the whole platform can be self-hosted on your own infrastructure.

Cloud provider dashboards store application configuration in plaintext or decipherable hashes, hand out access at the account level, and force a restart whenever a value changes. Keyshade replaces that arrangement with a service built to hold secrets and variables and deliver them into your runtime in real time.

Encryption relies on public key cryptography backed by elliptic curve cryptography, so values stay encrypted at rest and in transit. Teammates can use secrets in a runtime environment without ever holding the private key, which ends the habit of forwarding credentials through email or a chat platform.

Around that core sits the tooling a growing team needs.

• Live updates: changes reach the running application without a restart or a redeploy.
• Environments: development, staging, and production hold separate values that the codebase references by name.
• Versioning: secrets and variables keep a history, so an older configuration can be restored.
• Rotation: credentials rotate on a regular basis without any change to the application.
• Workspaces and roles: secrets organize into workspaces and projects, and custom roles decide who can do what.
• Event tracking: every action is logged with who did it and when, and access is monitored for anomalies.

Integrations connect Keyshade to other tools and platforms, and the documentation carries a detailed setup guide. It suits teams that have outgrown scattered dotenv files but do not want their configuration legible to anyone holding a cloud console login.

Phase is a secrets platform for engineering teams that ship often, covering application secrets and environment variables from a developer laptop through to production. It removes the drift that appears once the same credential lives in a dotenv file, a CI settings page, and a cloud console at the same time.

This repository holds the Phase Console, the dashboard where secrets are created, rotated, diffed, and restored. Around it sit separate repositories for the CLI, the Node, Python, and Go SDKs, a Helm chart, a Kubernetes operator, and a Terraform provider, all documented in one place.

The pieces fit together around a handful of capabilities.

• Runtime injection: the CLI imports existing dotenv files and injects secrets into a process at runtime or into a virtual shell.
• Access control: role-based, cryptographic permissions apply per application and per environment.
• Secret sync: values push automatically to GitHub, GitLab CI, Vercel, Cloudflare Pages, Railway, and AWS Secrets Manager.
• Kubernetes and Terraform: the operator syncs secrets into a cluster and reloads deployments, while the provider covers infrastructure as code workflows.
• Referencing and overrides: personal secrets stay private to one developer, and values reference each other across apps and environments.
• Audit logs: every change and access event is recorded, with version history and one-click restore of an older value.

A REST API covers whatever the SDKs do not. Start on the hosted console for the quickest path, or run the whole platform on your own infrastructure using the documented self-hosting route.

Environment variables end up scattered across dotenv files, chat messages and CI settings, and nobody is certain which copy is current. Shelve centralizes them in one vault organized by project and environment, then gives you the tooling to pull them back into a terminal or a pipeline on demand.

Secrets are hashed with SHA-256 and encrypted with AES-256 at rest, and environments such as development, staging and production sit alongside any custom ones you define. The stack is Nuxt with Nitro on the server and PostgreSQL through Drizzle, with the interface built on Nuxt UI.

Most of the design effort went into how a developer actually reaches a secret.

• CLI: pull, push and inject secrets straight into a process from the terminal.
• Command palette: search, navigation and actions from a single keyboard shortcut.
• GitHub sync: repository and Actions secrets stay aligned through the official GitHub App.
• Secure sharing: a built-in vault issues time-limited links for handing a secret to someone.
• Workspaces: teams organize projects under owner, admin and member roles.
• Zero config: projects are detected automatically and defaults are filled in.

Shelve is Apache 2.0 licensed with no core features held back, and self-hosting is documented for a Vercel deployment. The roadmap points at configuration sync across several repositories, deeper platform integrations and workflow automation, on the way to what its author calls a unified developer workspace.