Get database passwords and API keys out of .env files

Keep

Versioned, encrypted secrets with path-based access.

Store secrets at paths like db/prod/password and read them at startup or on demand. Every write creates a new version, so you can see history and read an earlier value. Access tokens can be limited to read-only, and PURGE removes a secret and all its versions for good.

Use it from your app

typescript

import { ShrouDB } from "@shroudb/sdk";

const db = new ShrouDB({
  moat: process.env.SHROUDB_URL,   // e.g. http://localhost:8200
  token: process.env.SHROUDB_TOKEN,
});

// At startup, instead of reading process.env.DATABASE_URL
const { value } = await db.keep.get("db/prod/url");
const databaseUrl = Buffer.from(value, "base64").toString();

What it does

Secrets stored at paths, encrypted at rest.
Every write creates a new version. Read any earlier version.
Tokens can be limited to read-only access.
Soft delete keeps history. PURGE removes every version permanently.
Fetch several secrets in one round trip.

Turn it on

Keep runs inside Moat, the ShrouDB server. Add this to moat.tomland restart. It shares Moat's encrypted storage, access tokens, and audit log with the other engines.

moat.toml

[engines.keep]
enabled = true

Commands

Over RESP3, prefix each command with KEEP. Over HTTP, send POST /v1/keep {"args": [...]}. The SDKs have a method for each.

Command	Args	Description
PUT	<path> <base64>	Store a new version
GET	<path> [VERSION <n>]	Read the latest or a specific version
VERSIONS	<path>	List versions
LIST	[prefix]	List secret paths
DELETE	<path>	Soft-delete, keeping history
PURGE	<path>	Delete permanently, all versions

Try Keep locally

The quickstart takes about five minutes.

Quickstart All engines