A fallback cache that keeps reads working through an outage, and an open-source CLI

An opt-in cache that keeps your applications reading through an outage, in the CLI and all six SDKs, plus the CLI source is now public.

Reading through an outage

Turn the cache on and every secret a machine reads is kept as an encrypted copy on that machine. If SikkerKey becomes unreachable, whether that is your network or ours, the read is served from that copy and your application carries on.

The cache steps in only when no answer reaches your machine at all. Whenever SikkerKey does answer, that answer is what your application gets: a revoked grant or a deleted secret fails the read exactly as it does today. Access that has been taken away stays taken away, outage or not.

Encrypted to the machine that wrote it

Each cached secret is sealed with AES-256-GCM under a key derived from the machine's own Ed25519 identity. A cache file that leaves the machine, in a backup, a synced folder, or a container image layer, cannot be opened anywhere else. Every entry is bound to its vault, machine, and secret, so entries cannot be altered or swapped between secrets.

In the CLI

The cache stays off until you turn it on:

sikkerkey cache enable
sikkerkey cache status     # whether it's on, and how many secrets are cached
sikkerkey cache clear      # delete the cached copies

Add --offline to get, run, or export to read from the cache directly, either to check your setup or when you already know the machine is disconnected:

sikkerkey get sk_a1b2c3d4e5 --offline
sikkerkey run --all --offline -- ./app
sikkerkey export --offline

In the SDKs

One chainable call turns it on:

const sk = SikkerKey.create().enableCache()

Available in Kotlin/JVM, Node.js, Python, Go, .NET, and PHP, each using its own naming convention. Two options shape it: maxAge sets how old a cached value may be and still be served during an outage, and onFallback fires with the secret id and the time it was cached whenever a value comes from the cache, so you can log it or count it. A fallback is otherwise silent.

The cache format is the same in the CLI and every SDK, so a copy written by one is readable by the others on the same machine.

The CLI is now open source

The SikkerKey CLI is public at github.com/SikkerKeyOfficial/sikkerkey-cli under the MIT license. It is the part of SikkerKey that runs on your own machines, so you can read exactly how it resolves your machine identity, signs every request, and encrypts the cache described above.

Installing is unchanged:

npm install -g sikkerkey

And it now installs with the Go toolchain as well:

go install github.com/SikkerKeyOfficial/sikkerkey-cli@latest

Every published release is built from a tagged commit in that repository, with provenance you can verify on npm.

Documentation is moving

The documentation is moving to sikkerkey.com/docs, section by section. Pages that have already moved redirect from docs.sikkerkey.com to their new address, so your existing links and bookmarks keep working and there is nothing to update on your side. The sections still to come are served from docs.sikkerkey.com until their turn. Once the move is finished, docs.sikkerkey.com will be retired.