SikkerKey Blog
Security writeups, engineering deep-dives, and practical guides from the team building SikkerKey.
RSS feed
SikkerKey Presents RatelKey: Self-Hosted Secrets Without the Setup Burden
Meet RatelKey: run a Burrow on your own infrastructure, give applications explicit access to secrets, and manage backups, audit logs, and updates from one place.
AWS SigV4 vs SikkerKey: Why Asymmetric Signing Is Stronger for Secret Retrieval
AWS SigV4 is symmetric request signing. SikkerKey is asymmetric secret retrieval: every machine signs with its own Ed25519 private key, while SikkerKey verifies with public keys and enforces live per-secret access.
EU Alternatives to AWS Secrets Manager and Google Cloud Secret Manager
A capability-first comparison of SikkerKey, OVHcloud, Scaleway, AWS, and Google Cloud—and what separates a dedicated secrets platform from a cloud vault.
Strong Authentication In, Bearer Token Out: The Credential Downgrade
Strong authentication does not automatically produce strong sessions. When proof of identity is exchanged for a copyable bearer token, that token becomes the real security boundary and the thing attackers target.
Bring Your Own Key (BYOK): What It Is and How It Works
Bring your own key (BYOK) lets you hold the encryption key for your data in your own cloud KMS, so you control when the vendor can decrypt it. What BYOK is, how it works, what it does and doesn't change, and how SikkerKey offers it alongside managed keys.
Your MCP Server Has Secrets. Can the AI Read Them?
A practical answer for teams using Claude Code, Codex, and other coding agents: when AI agents can read secrets, when they cannot, and how SikkerKey keeps MCP secret management read-blind.
Dynamic Secrets vs Leased Credentials: What's the Difference?
Dynamic secrets (HashiCorp Vault, Infisical, etc) and SikkerKey's leased credentials both mint short-lived database logins on demand. The difference is how a machine proves it may mint one: a bearer token, or a signed request with nothing reusable issued.
Alternatives to .env Files
The simplest alternative to a .env file is to stop keeping secrets in files. With SikkerKey you bootstrap a machine in one command, and the CLI and SDKs read secrets with no token and no config, plus rotation, a full audit log, and per-secret access.
Hvordan beskytter man sine API-nøgler? Guide til sikker håndtering af applikationshemmeligheder
API-nøgler og secrets lækker fra .env-filer, git-historik og CI-logs. Sådan beskytter du dine applikationshemmeligheder i praksis, og sådan binder SikkerKey adgang til en signeret maskinidentitet.
Secrets Manager Pricing: Is Your Team Spending Too Much In 2026?
A SikkerKey-first 2026 pricing comparison showing how managed secrets manager pricing changes across machines, identities, users, secrets, versions, and usage meters.
Simple Secrets Manager: Why SikkerKey Is Easy to Adopt
SikkerKey is a simple secrets manager because it absorbs the hard parts behind straightforward methods and intuitive UI: bootstrap a machine, grant specific secrets, and let read-only SDKs in six languages use that machine identity automatically.
Traditional vs Modern Secrets Management In 2026
Traditional secrets managers use your strong login only to mint a weaker bearer token, then bolt crutches like short expiry and rotation around it. A modern secrets manager proves a machine's identity on every request instead, so there is nothing reusable to steal.