Secrets management for any application that needs a credential at runtime.
Store database URLs, API keys, OAuth tokens, and certificates. Applications fetch them by signing each request with a key generated on the host. The application never holds a credential that could leak from a CI log or a checked-in env file.
Most secrets leak because they live somewhere they shouldn't.
API keys end up in source control. Database URLs sit in .env files copied between developers. Long-lived tokens hang around in CI logs and Slack messages. Service accounts get baked into Docker images that get pushed to public registries by accident.
Anything that proves access by being a string of characters can leak the moment someone reads it. The breach reports keep listing the same root cause: a credential ended up in a place where someone who shouldn't have it could read it.
Machines authenticate by signing each request.
Setting up a machine is one command. The bootstrap script generates an Ed25519 keypair on the host. The public half is registered with SikkerKey. The private half is written to a file readable only by its owner, and never leaves the machine.
From then on, every request the application makes is signed locally with that private key. SikkerKey checks the signature against the public key it has on file. The signed payload includes the HTTP method, path, a timestamp, and a one-time random value — so even a request captured on the network can't be re-sent by anyone else.
There's no bearer token for an attacker to steal from a CI log. There's no API key to commit to a repo by accident. The thing that proves a machine is allowed to read a secret is the same kind of artifact that protects an SSH session — a private key sitting on one disk.
Fetching a secret is one SDK call, or one CLI command.
Your code asks for a secret by ID. The decrypted value comes back on the same line. Signing, replay protection, and key resolution happen inside the SDK or CLI without configuration.
SDKs for Python, Node.js, Go, Kotlin, and .NET. The CLI is a single binary installed with npm install -g sikkerkey or go install, with no runtime dependencies.
The mechanism doesn't change with team size — what you turn on alongside it does.
A solo developer running a Discord bot bootstraps one machine and never touches secrets again. A team running fifty production services bootstraps each one the same way, scopes access per project, and reviews the audit log. The authentication model is the same; the controls layered on top scale with the room you're operating in.